There once was a time when we were in control of our identity. When we met
someone we were in control of who we were to them. We could present ourselves
as whatever version of ourself we chose: the intellectual, the party animal,
the sports fan. We could withhold information, and the balance of probabilities
was that the information we withheld would be left undiscovered.
This control of identity is something many generations have taken for granted.
How could it be any other way?
The internet has changed this. No longer are our identities under our complete
control.
Analytically I’ve known this for a long time. I’ve understood that the internet
is forever; that no matter what Twitter or Facebook tell you about privacy
settings and access control that basically you should assume whatever you put
on the internet is genuinely public. I have known these facts, and I had
believed I had internalised them.
I had not. In particular, what I’d not grasped is that this permanence
represents a real risk to anyone who is on the weak side of a power disparity.
If you’re in a minority or disadvantaged group (women, people of colour, the
mentally ill), or even if you’re simply engaged in an interaction between
people who aren’t equals, the data permanence of the internet becomes a weapon
that can be used to threaten, intimidate and harm.
Like anyone in a privileged group (in my case white, male and middle-class),
the lesson only truly set in when I accidentally found myself digging in to it.
Allow me to walk you through my discovery process.
Yesterday, I was walking around Boston, being a typical tourist. I met many
people: some kind, some not kind, many chatty. I had short discussions with
a good 30 or 40 strangers at some point during the day.
Like any friendly discussion, a few basic bits of information featured in most
of these conversations. These are things like names (usually just first names),
jobs, which city people live in. Prior to the internet this information was
harmless. Knowing that my name is Cory, that I live in London, and work in
software, is generally useless to you without the internet. To take advantage
of that knowledge to learn more about me without the internet requires huge
resources and investment of time and effort that puts it beyond most casual
explorers.
One person I met, in an effort to be friendly, struck up a bit of conversation.
They had an unusual name, and happened to mention that they had another
relative with the same name who attended a specific university. This is
trivial information. Nothing of note here.
Except, as I discovered, it’s trivial to turn that information into something
far more substantial. In a fit of boredom I opened Google and within 5 minutes
I’d added the following bits of information that I had not been told:
- Last name
- Which university they attended
- What they studied
- Some academic works
- Family members’ names
- Partner’s name
This was so easy that it didn’t even trip my ‘holy shit this is creepy filter’.
Not until I discovered an article mentioning that one of their family members
had been charged with a crime did I realise how totally terrifying what I’d
just done was.
Let’s be clear: that activity I just engaged in is both unethical and creepy.
I believe that people should have the right to present information in a
controlled way to people they don’t know. This is because information is
powerful.
Consider the scenario where, rather than being myself, I were a rapist and the
person I just researched was a woman I’d identified as a ‘target’. In a social
interaction they have inevitably already forgotten, in which they disclosed
nothing of note or problem, I was able to obtain all that information.
This is terrifying. I have no doubt that if I were to spend two hours and real
effort on this task I could determine a home address for this person. I could
track down friends, I could build up incriminating information. I could put
myself into a situation where I can abuse the already existing power disparity,
which my ‘research’ has magnified.
For those of us fortunate enough to be in a position of privilege, the openness
of the internet does not represent a particular threat. This is what leads
people like Chad Whitacre to propose policies of radical transparency, where
organisations like Gittip will run their businesses entirely in the open. I
have met and respect Chad, and I don’t believe he ever intends to put anyone at
risk. But, as has been mentioned by
better people than I,
it’s possible that Chad’s relative privilege makes him less-able to empathise
with those who are at risk: mine certainly does.
For those without the privilege (or even simply with less privilege),
however, the internet represents a threat. It represents a tool that can be
used to quickly obtain information you never intended for another party to
possess. That information can then be used as a weapon, just as easily as it
can be used for benevolent purposes.
We can try to mitigate this by talking about privacy policies, and access
control, and not putting online information you wouldn’t be happy with
everyone having access to. But that’s not enough.
We need a new generation of social internet services. One that reflects our
mental model of social interaction: where what someone finds out about me is
controlled entirely by me; where people I have not explicitly offered
information to cannot see anything about me (or even that I exist); and where
the social graph represents the asymmetry of human relationships.
I didn’t really understand the need for those services before. I do now. It’s
time we started to make that happen. I don’t have concrete plans for this yet,
but I’m going to start thinking about it from now on.
And to the person whose privacy I just unthinkingly and cruelly violated, I am
so sorry. I allowed my idle curiosity to get the better of me, and it didn’t
even occur to me that I had crossed a line until far too late. It was a
terrible way to repay your friendliness, and I am unreservedly sorry.
Note: I have made every effort to anonymise this post to avoid having others
repeat my investigation. I’ve done enough damage. I have not reached out to the
individual whose privacy I violated to apologise in person, because if
listening to Ashe Dryden and Shanley Kane has taught me anything it’s that
violating someone’s social space in order to apologise for violating their
social space is making a bad situation worse.