How to Not Protect Your Users

Two weeks ago, Twitter sent my personal info to a group of creeps and stalkers who have been harassing me for well over a year. This is the story of how and why that happened, which I’m relating in hopes that Twitter will do better.

My info was sent to these people because I filed DMCA takedown claims. I filed those claims when the creeps began, yet again, to tweet a private photo of mine into abuse-prone hashtags, in an attempt to start a dogpile. Most of the users I filed against had previously been suspended, banned, or made to delete tweets about me on numerous prior occasions.

I filed these takedowns because the photo was mine, and I’d given up on expecting Abuse to take action. This was the second time this group had tweeted/retweeted my personal photos with intent to intimidate. The last time, they took a picture of my baby.

Each time the creeps used my photos to harass, I’d recently written something they didn’t like…and, in their own words, they needed to “expose” me[1]. The most recent writing necessitating my exposure was a contributed piece in Fast Company. It briefly mentioned antivaxxers (the creeps are antivaxxers), but was mainly about algorithmic news filters on Facebook and how they impact policy. The time they took my baby’s photo, my offense was a data analysis of Antivax Twitter that Wired featured during California’s fight to eliminate vaccine opt-outs; that article highlighted the elaborate tactics at work in the fight to win over the legislators. And it’s worth noting that despite this elaborate justification, I’m also not the first person this group has taken private photos from and attempted to smear.

But the point of this post isn’t that some assholes are Mean on the Internet. It’s to call attention to where things went wrong at Twitter, because that’s my concern: how Twitter’s reporting flow pushes users towards copyright because it’s incompetent at managing harassment, and how Twitter must take stronger steps to prevent personal identifying info situations from happening to other users.

“User is tweeting pictures of my infant repeatedly as part of an intimidation campaign and that’s ok?”

If a stalker or troll decides to use your own personal photos to harass you, you must first decide how to report. One option is “someone is posting private information”, which encompasses personal details as well as photos. The second is harassment. If you visit the page for reporting private information, copyrighted material is a prominent subsection, with a link out to the relevant copyright claims forms.

Last June, when this group of creeps began to tweet/RT my baby’s photo, the first option I tried was disclosure of private information. But it seems that “private photo” is a euphemism for “naked photo”, and since Twitter couldn’t “determine a violation” based on the report from the parent of the underage infant whose image was being tweeted, a form email arrived a few hours later.

The form email helpfully points out that if you own the rights to that picture of your baby, you can always request it get taken down via a copyright claim.

At the time, I didn’t know anything about copyright, so I turned to harassment reporting…because tweeting/RTing a photo of someone’s child to intimidate them is harassment. And in fact, on the same day, the same creeps were simultaneously RTing a stalker photo of the back of my head on a public street that a friend of theirs had surreptitiously taken. Baby pic + stalker pic. Harassment.

48 hours went by. Nothing happened beyond the arrival of a form email: “When did this harassment begin to occur? Can you send us some more tweets?”

Concerned, I started making inquiries…and I was told that invoking copyright protection was actually a remarkably fast and effective way to get things dealt with within Twitter’s halls, since they were concerned about their own liability. So, since I owned the image of my baby, I filed my first DMCA takedown request (against that picture only, obviously, not the stalker photo…I didn’t hold the rights to the stalker photo).

Boom! The response through the copyright-reporting channel took minutes; the photo of my infant that I’d tried to have removed for 2 days was down within a half hour. I was relieved. And I never realized that I had just sent all of my family’s private information to the creep who had posted it.

Here’s why:

The form starts with this section. Owner contact info.

And then there’s a break. When you select the platform the violation occurred on (Twitter or Vine), the address section scrolls away and a new section of the form appears.

That’s where you enter your complaint details. And when you’re done, if you have nothing more to add to the report, this last section appears.

As both my stalkers and Twitter’s policy guy Nu Wexler have taken pains to point out, there is undeniably a sentence here alerting the complainant that Twitter may provide the affected user with a copy of the complaint. So, if you’re Mr. Wexler, you can certainly point the finger (or those red arrows) at me and imply that I caused this whole situation (well, minus the part where people tweeted my private photos to harass me). If you know already know the specifics of DMCA law, perhaps the meaning of “may” is obvious. But if you’re the average user who doesn’t know anything about copyright law, and wound up here because of a harassment or revenge porn case that Abuse punted, botched, or simply took a week to get to, that sentence is a joke. “May” give a copy? Vague AF. Try “will” send a copy, or “is legally bound” to send a copy, and clearly note that it’s not just the complaint section of the form, but that initial address section too.

Other platforms with far less abuse are way more on top of this than Twitter. Wordpress and Github articulate in bold text that they will not redact your personal info, so you should use a proxy in situations in which you wouldn’t want your home address sent to the person you’re filing against. Instagram and Facebook state that they only send the email address as a contact detail and still make clear that email will be divulged. DMCA as a proxy for dealing with harassment is sadly a reality these days, and other platforms recognize that and protect their users.

“The man who stole the photo has been stalking me on your platform for months.”

Fast forward to the present: on May 13th 2016, this group of longtime harassers began to tweet yet another of my photos into harassment hashtags, alongside memes and links to YouTube videos that they’d made. After the baby pic experience, I simultaneously filed DMCA takedowns and abuse reports. I clearly and unambiguously used the word “stalker” in the complaint section, and referenced the long prior history of harassment, suspensions, etc. And again, I didn’t file against the (huge quantity of) harassment materials I didn’t own.

The same thing happened: the photo I reported via copyright came down within 20 minutes.

I didn’t receive any response to the harassment reports for one full week this time. Twitter did absolutely nothing.

“Twitter emailed me her contact info.” “Which pic did she complain about? I’ve got a lot of pics up.”

A few days later, my stalkers began to publicly gloat about Twitter sending them my private information. They began to tweet the version of the pic that I’d uploaded as evidence to Dropbox, then posted the Dropbox link to Reddit and other sites, claiming I was a public figure trying to “suppress their voice” in an effort to incite even more harassment. I emailed Twitter Abuse immediately — what is this about? What did you send them?

I got no response from Twitter until other people began RTing my comments about the situation. And then, this form letter arrived on May 23rd.

This is perhaps the single most galling part of this experience: this email should’ve been sent immediately — automatically — when a takedown notice arrived with the word “stalker” in it. Alternately, this degree of specificity should show up by default in their Copyright and DMCA policy (it doesn’t). The fact that it only arrived once I started to publicly complain about this incident, 10 days after it occurred, is appalling.

This form email suggests that Twitter is well aware that its users are resorting to copyright to combat harassment. When I asked someone why it had taken so long to send, the response came back: wait, we hadn’t sent you this email earlier?

“Hope is not a strategy.” — analyst downgrade

Twitter must fix this. Its brand is increasingly defined by excessive harassment. Growth is suffering; no quarterly earnings call happens without someone referencing the ‘troll problem’. The company’s notorious inability to handle harassment as harassment, and the flow of its own reporting systems, guarantees that users who just want to stop their private photos from being misused will use that takedown form. And when they do, they are unknowingly, inadvertently sending their information out to terrible people.

I want to make one final point: I did not “abuse” the DMCA to “silence” some valiant group of freedom-fighters, despite the 400+ tweets that this group of creeps has sent out about me over the past week in an effort to muddy the waters and recast themselves as the victims. Despite their bleating justifications, taking and tweeting my personal photos into harassment hashtags is not “Fair Use”. It isn’t commentary or criticism of a “public figure”. This is just a group of creeps who have been harassing me (and many others) for a full year : 500+ mentions of my name or handle from behind blocks this month alone, over 70 tweets (incl the ones with my photo) the weekend they kicked off the latest round of harassment; creating blogs and multiple YouTube accounts dedicated to bizarre/conspiracist/false stories about me; incessantly @-spamming complete strangers, friends, colleagues, and journalists alike with these “exposés”; actively, frequently encouraging others to harass me; and tweeting/RTing stolen photos of my child and stalker photos of me.

This is a clear-cut case of Abuse. It should have been handled as abuse.

Twitter failed on so many levels.

I am frankly furious that I even have to tell this story; it isn’t what I want to be talking about, or working on.

If, for any reason, you are still driven to use a copyright infringement claim to get your own personal photos removed — say, because Twitter hasn’t yet built a functional harassment reporting platform — please use a proxy and keep yourself safe.

[1] You’ll have to take my word for it — or use common sense — but despite the unending, foamy rantings of this group of crazies, I am not: paid by pharma, a “pharma whore”, a paid shill, secretly working for Hillary Clinton, the mastermind behind a secret cadre of social media accounts that spend all day on social networks fighting with parents who claim to have vaccine-injured children, or a bad mom who ‘assaults activists’ at public hearings.

I am a volunteer who, with a few other moms, helped organize and pass last year’s CA law eliminating ‘personal belief’ vaccine opt-outs in schools. Unfortunately, many of us who advocated for it were targeted, stalked, and harassed; the Senator who sponsored the law received death threats.

It’s also worth noting that although these specific creeps are antivaxxers, that isn’t the point. Plenty of people don’t vaccinate their children and also don’t behave like this. Despite my harasser’s attempts to reframe the issue as one of some injustice done to them, my goal is to keep the focus on Twitter’s serious screwup, in hopes that this doesn’t happen to anyone else. They are just a sideshow.