Digital Safety & Privacy: �Dox(x)ing & online abuse

​

Prepared by: Matt Mitchell & Sarah Aoun

@saoun�@geminiimatt��`

​

​

​

$whoami: MATT

• Hacker & security researcher
• Director of Digital Safety & Privacy at Tactical Tech
• Operational security & digital safety trainer w/ GJS Security
• advisor to the Open Technology Fund , Internet Freedom Festival , Human Rights Foundation.
• developer and former data journalist (formerly of NY Times)
• 2016-17 Mozilla/Ford Open Web fellow at Color of Change
• 2016-17 Internet Freedom Festival fellow
• 2016-17 New America Cybersecurity Initiative fellow
• 2017 Institute For The Future Future for Good fellow
• Founder of CryptoHarlem

​

​

​

​

​

$whoami: SARAH

• Digital safety & privacy trainer with human rights defenders, journalists, movement groups, and nonprofits
• Director of Tech at Open Tech Fund
• 2017-2018 Ford-Mozilla Open Web Fellow
• 2016-2017 Internet Freedom Festival Fellow
• Digital Safety trainer with GJS Security
• Security & Privacy consultant with the Human Rights Foundation
• Organizational security with The Engine Room
• Consultant with (RAD) Research Action Design
• Developer and programmer

​

​

​

Twitter: @sa0un

​

​

​

Doxxing and Online Abuse:

​

Congratulations you are here! At kickstarter, living the digital dream. However, no matter what you do here you are KICKSTARTER.

​

A doxxing and online abuse an unfortunate part of the internet.

​

​

Make a checklist as you learn...

1. You should be able to follow the checklist 6 months from now .
2. You should be able to follow when you are under stress or duress.
3. Keep the language simple and the list down to ten items or less.
4. It’s ok to have to more than one checklist if needed.
5. Tips for good & great lists

DIGITAL SAFETY:

Social Engineering

The weak point of all systems is the human…�can people be hacked?

For parents

Privacy considerations: posting information and images online leaks data.

secure your data:

your Google profile stores all personal information, including searches.�Use My Activity to remove content & activity controls to stop it from being collected.

​

​

​

​

HTTPS:// MYACTIVITY . GOOGLE . COM

doxxing:

doxxing is the act of publishing someone’s personal information, of which there would be a reasonable expectation of privacy and dubious value to the conversation, in an environment that implies or encourages intimidation or threat. �- crashoverridenetwork.tumblr.com

​

​

what to do if doxed / targeted online...

• Take screenshot of the offending material.
• Speak to someone who makes you feel safe.
• If you feel you may be in danger, go somewhere you feel safe. .
• Report the abuse to the platform: facebook, twitter, instagram.
• Block the user on the platform.
• Contact law enforcement and/or CERT - Emergency Response team.
• Use sites like myactivity.google.com , spokeo.com , pipl.com to see how much information you leave online. Try to get it removed.
• Use sites like talkwalker, google alerts, to set up look out for other abuse.
• Don’t post “i just got hacked” on social media.
• Turn on two factor authentication (2fa.directory) for other accounts
• Contacts others (colleagues, friends, etc) who may be affected.

​

what to do if doxxed / targeted online...

1. don’t panic!
2. document as much abuse/harassment, as possible .�Use an archiver http://archive.org or http://archive.is/
3. use your backup phone & email to get help.
4. don’t stay silent, but don’t go public.
5. qualify the risk to your physical safety
6. seek support of friends, family &/or professionals.

​

​

“revenge porn”:�(sharing explicit footage of someone without their consent)

Communicaitons decency act: 47 U.S. Code § 230. Protection for private blocking and screening of offensive material

Additional resources: cyber civil rights initiative

​

​

“One of the most common reactions to threats of revenge porn is to erase the communication and avoid,” she explains. “Don’t. If it’s through texts, take screenshots that record the time they were sent. Stay calm. You are not alone and there are resources to help.”

​

If someone does violate your privacy and distribute the images, she says, “preserving the evidence is crucial for seeking justice.” According to Carrie, most social media platforms have ways to report instances of NCP.

“If the victim took the picture then she owns the copyright and can demand it be removed as a violation of her copyright,” explains Carrie. “Search engines like Google and Yahoo also have policies that enable victims to remove the content from their search engine results. This is a big deal because in most cases personal identifying information like [the victim's] name and address is posted alongside the revenge porn.”��“If you feel comfortable, inform close friends and family that someone has violated your privacy and enlist them to screenshot and preserve any evidence they find,” she says. “Google yourself regularly and don’t forget to check the images tab as well.”

​

​

​

​

​

​

“swatting”:�

“Targeted ads”:�

“Opting out”:�

“Behavior online”:�

Managing risks… social media basics

1. Dont keep your profiles public.
2. Dont accept random friend request.
3. Dont post work information on your personal account.
4. Dont post work photos without checking for details in background.

​

​

digital safety: facebook

digital safety: facebook

Turn on two factor authentication in settings.

​

digital safety: facebook

Start security checkup by typing “security checkup” in (?)

“where do they get the data?”:�

Data brokers & OSINT tools

“mitigations”:�

secure yourself:

a. use tor browser for anonymous internet & remove your pii

​

​

abine cost $129/year to delete your personal identifiable information from data brokers.

look yourself up on sites like spokeo, pipl,& intelius to get an idea of how much is out there.

allclear id alert network is a free service. you also can manually opt-out from some services w/ prc.

secure yourself:

b. try to protect your utilities & internet service from “social engineering” by adding a note in your profile.

​

​

some services allow you to add additional security like a special pin number or passphrase before information is given and/or changes are made.call to ask about these privacy measures.

secure yourself:

c. turn off personal info leaked from devices.

​

secure yourself:

c. turn off personal info leaked from devices WIN 8. �

​

secure yourself:

c. turn off personal info leaked from devices.WIN 10

​

secure yourself:

c. turn off personal info leaked from devices.IPHONE

​

secure yourself:

c. turn off personal info leaked from devices.ANDROID

secure yourself:

c. turn off personal info leaked from devices.OS X MAC

secure yourself:

c. turn off personal info leaked from devices.bluetooth

TURN OFF BLUETOOTH BLE (bluetooth low emission) devices when traveling or not in use . Definitely consider changing the name of the device & removing your name from it, if it is there. More info on dangers: http://www.contextis.com/resources/blog/emergence-bluetooth-low-energy/�

Contact: @geminiimatt

Nothing to hide

DISAPPEAR is the sequel to the film “NOTHING TO HIDE”�below.

fin !!! questions?

please comment slides or tweet me your questions!

Great videos & answers in these resources (i am quoted).

T

twitter: @GeminiiMatt <- best place to reach me�GPG: 0x0b8770aa07046231�Keyid: 0x78913ff0a3008385�fingerprint: 381A B2F0 0378 2939 B00C 467F 0B87 70AA 0704 6231�keybase.io: geminiimatt�Wire: geminiimattx�wickr.com: geminiimattx�threema: geminiimattx ( D7MMDUZ8 )�whatsapp: geminiimatt�ricochet: ricochet:snlxgyf2nxm3gp7p <- subject to change�otr/XMPP: geminiimatt@jabber.calyxinstitute.org�peerio: geminiimattx�semaphor: geminiimatt�

T A K E C A R E O F E A C H O T H E R !