I recently finished reading
Little Brother from
Cory Doctrow, it was one of those books that you read that mirrors what is happening now and projects a rather worrying trend forward. It shows how much we are slipping towards a surveillance society and, yes, the title is a nod to Big Brother by George Orwell.
Recent news that the FDA in the US is now licencing drones to fly over the USA is somewhat troublesome. Personally I can't wait until some unknown citizen launches their own counter-drone to bring one down.
This is the
text of a post from
Dr Brooke Magnanti it has some good tips, there are certainly other things that you can do, such as VPNs / proxies / Tor, or as I do, meet up with people in Second Life.
She is also going to be in the BBC Radio to talk about this very topic starting 13:45 Mon 31 Dec 2012 It should be worth a listen!
How To Blog Anonymously (and how not to)
Further to
yesterday's post, this is a list of thoughts prompted by a request from
Linkmachinego
on the topic of being an anonymous writer and blogger. Maybe not
exactly a how-to (since the outcome is not guaranteed) as a post on
things I did, things I should have done, and things I learned.
It's
not up to me to decide if you "deserve" to be anonymous. My feeling is,
if you're starting out as a writer and do not yet feel comfortable
writing under your own name, that is your business and not mine. I also
think sex workers should consider starting from a position of anonymity
and decide later if they want to be out, please don't be naive.
Statistics I made up right now show 99 out of 100 people who claim 'if
you have nothing to hide you have nothing to fear' are talking out of
their arses.
The items in the list fall into three general
categories: internet-based, legal and real-world tips, and
interpersonal. Many straddle more than one of these categories. All
three are important.
This is written for a general audience
because most people who blog now do not have extensive technical
knowledge, they just want to write and be read. That's a good thing by
the way. If you already know all of this, then great, but many people
won't. Don't be sneery about their lack of prior knowledge. Bringing
everyone up to speed on the technology is not the goal: clear steps you
can use to help protect your identity from being discovered are.
Disclaimer:
I'm no longer anonymous so these steps are clearly not airtight. Also
there are other sources of information on the Web, some of which are
more comprehensive and more current than my advice. I accept no
responsibility for any outcome of following this advice. Please don't
use it to do illegal or highly sensitive things. Also please don't use
pseudonyms to be a dick.
This is also a work in
progress. As I remember things or particular details, I'll amend this
post. If you have suggestions of things that should be added,
let me know.
1. Don't use Gmail, Yahoo, Hotmail et al. for your mail.
You
will need an email address to do things like register for blog
accounts, Facebook, Twitter, and more. This email will have to be
something entirely separate from your "real" email addresses. There are a
lot of free options out there, but be aware that sending an email from
many of them also sends information in the headers that could help
identify you.
When I started blogging, I set up an email address
for the blog with Hotmail. Don't do this. Someone quickly pointed out
the headers revealed where I worked (a very large place with lots of
people and even more computers, but still more information than I was
comfortable with). They suggested I use
Hushmail
instead, which I still use. Hushmail has a free option (though the
inbox allocation is modest), strips out headers, and worked for me.
A
caveat with this: if you are, say, a sex worker working in a place
where that is not legal and using Hushmail, you could be vulnerable to
them handing over your details to a third party investigating crimes. If
you're handling information some governments might consider
embarrassing or sensitive, same. Google some alternatives: you're
looking for something
secure and encrypted.
There
are a few common-sense tips you can follow to make it even safer. If
you have to bring people you know in real life in on the secret, don't
use this email address for communicating with them even if only about
matters related to your secret (and don't use your existing addresses
for that either). Example: I have one address for press and general
interactions, one for things related to my accountant and money, and one
for communicating with my agent, publisher, and solicitor. I've also
closed and opened new accounts over the years when it seems "too many"
people are getting hold of a particular address. Use different passwords
for each, don't make these passwords related to your personal
information, and so on.
I unwisely left the Hotmail address
going, and while I did not use it to send mail, I continued to read
things that arrived there. That led to
this failed attempt by the Sunday Times to out me. It was an easily dodged attempt but something I would have preferred to avoid.
People
can and do register internet domains while staying anonymous but I
never did. Some people registered domains for me (people I didn't know
in person). This led to a couple of instances of them receiving
harassment when the press suspected they were me. In particular
Ian Shircore got a bit of unwanted attention this way.
Because
all I was ever doing was a straight-up blog, not having a registered
domain that I had control over was fine. Your needs may be different. I
am not a good source for advice on how to do that. But just in case you
might be thinking "who would bother looking there?" read about
how faux escort Alexa DiCarlo was unmasked. This is what happens when you don't cover your tracks.
2. Don't use a home internet connection, work internet connection, etc.
Email
won't be the only way you might want to communicate with people. You
may also want to leave comments on other blogs and so forth. Doing this
and other ways of using the Web potentially exposes
your IP address, which could be unique and be used to locate you.
Even if you don't leave comments just visiting a site can leave traces behind.
Tim Ireland recently used a simple method
to confirm his suspicion of who the "Tabloid Troll" twitter account
belonged to. By comparing the IP address of someone who clicked on to a
link going to the Bloggerheads site with the IP address of an email
Dennis Rice sent, a link was made. If you go to the trouble of not using
your own connection, also make sure you're not using the same
connection for different identities just minutes apart. Don't mix the
streams.
The timing of everything as it happened was key to why the papers did not immediately find out who I was. The
old blog
started in 2003, when most press still had to explain to their audience
what a blog actually was. It took a while for people to notice the
writing, so the mistakes I made early on (blogging from home and work,
using Hotmail) had long been corrected by the time the press became
interested.
Today, no writer who aims to stay anonymous should
ever assume a grace period like that. It also helped that once the press
did become interested, they were so convinced not only that Belle was
not really a hooker but also that she was one of their own - a
previously published author or even journalist - that they never looked
in the right place. If they'd just gone to a London blogmeet and asked a
few questions about who had pissed off a lot of people and was fairly
promiscuous, they'd have had a plausible shortlist in minutes.
After
I moved from Kilburn to Putney, I was no longer using a home internet
connection - something I should have done right from the beginning. I
started to use internet cafes for posting and other activities as Belle.
This offers some security... but be wary of using these places too
often if there is a reason to think someone is actively looking for you.
It's not perfect.
Also be wary if you are using a laptop or
other machine provided by your workplace, or use your own laptop to log
in to work servers ("work remotely"). I've not been in that situation
and am not in any way an expert on
VPNs, but you may want to
start reading about it here and
do some googling
for starters. As a general principle, it's probably wise not to do
anything on a work laptop that could get you fired, and don't do
anything that could get you fired while also connected to work remotely
on your own machine.
3. There is software available that can mask your IP address. There are helpful add-ons that can block tracking software.
I didn't use this when I was anonymous, but if I was starting as an anonymous blogger now, I would
download Tor and browse the Web and check email through their tools.
If
you do use Tor or other software to mask your IP address, don't then go
on tweeting about where your IP address is coming from today! I've seen
people do this. Discretion fail.
I also
use Ghostery now to block certain tracking scripts from web pages. You will want to look into something similar. Also useful are
Adblocker,
pop-up blockers, things like that. They are simple to download and use
and you might like to use them anyway even if you're not an anonymous
blogger. A lot of sites track your movements and you clearly don't want
that.
4. Take the usual at-home precautions.
Is
your computer password-protected with a password only you know? Do you
clear your browser history regularly? Use different passwords for
different accounts? Threats to anonymity can come from people close to
you. Log out of your blog and email accounts when you're finished using
them, every time. Have a secure and remote backup of your writing. Buy a
shredder and use it. Standard stuff.
Another thing I would do is install a
keystroke logger
on your own machine. By doing this I found out in 2004 that someone
close to me was spying on me when they were left alone with my computer.
In retrospect what I did about it was not the right approach. See also
item 7.
5. Be careful what you post.
Are you posting photos?
Exif data
can tell people, among other things, where and when a picture was
taken, what it was taken with, and more. I never had call to use it
because I never posted photos or sound, but am told there are loads of
tools that can wipe this Exif data from your pictures (
here's one).
The
content of what you post can be a giveaway as well. Are you linking to
people you know in real life? Are you making in-jokes or references to
things only a small group of people will know about? Don't do that.
If
possible, cover your tracks. Do you have a previous blog under a known
name? Are you a contributor to forums where your preferred content and
writing style are well-known? Can you edit or delete these things? Good,
do that.
Personally, I did not delete everything. Partly this
was because the world of British weblogging was so small at the time - a
few hundred popular users, maybe a couple thousand people blogging
tops? - that I thought the sudden disappearance of my old blog
coinciding with the appearance of an unrelated new one might be too much
of a coincidence. But I did let the old site go quiet for a bit before
deleting it, and edited archived entries.
Keep in mind however that
The Wayback Machine
means everything you have written on the web that has been indexed
still exists. And it's searchable. Someone who already has half an idea
where to start looking for you won't have too much trouble finding your
writing history. (
UPDATE: someone alerted me that it's possible to
get your own sites off Wayback by altering the robots.txt file - and even prevent them appearing there in the first place - and to
make a formal request for removal using reasons listed here.
This does not seem to apply to sites you personally have no control
over unless copyright issues are involved.) If you can put one more step
between them and you... do it.
6. Resist temptation to let too many people in.
If
your writing goes well, people may want to meet you. They could want to
buy you drinks, give you free tickets to an opening. Don't say yes.
While most people are honest in their intentions, some are not. And even
the ones who are may not have taken the security you have to keep your
details safe. Remember, no one is as interested in protecting your
anonymity as you will be.
Friends and family were almost all
unaware of my secret - both the sex work and the writing. Even my best
friend (A4 from the books) didn't know.
I met very few people
"as" Belle. There were some who had to meet me: agent, accountant,
editor. I never went to the Orion offices until after my identity became
known. I met Billie Piper, Lucy Prebble, and a couple of writers during
the pre-production of
Secret Diary at someone's house, but met almost no one else involved with the show.
Paul Duane and
Avril MacRory
met me and were absolutely discreet. I went to the agent's office a few
times but never made an appointment as Belle or in my real name. Most
of the staff there had no idea who I was. Of these people who did meet
me almost none knew my real name, where I lived, where I was from, my
occupation. Only one (the accountant) knew all of that - explained below
under point 9. And if I could have gotten away with him never seeing a
copy of my passport, I damn well would have done.
The idea was
that if people don't know anything they can't inadvertently give it
away. I know that all of the people listed above were absolutely
trustworthy. I still didn't tell them anything a journalist would have
considered useful.
When I started blogging someone once commented
that my blog was a "missed opportunity" because it didn't link to an
agency website or any way of booking my services. Well, duh. I didn't
want clients to meet me through the blog! If you are a sex worker who
wants to preserve a level of pseudonymity
and link your public profile to your work,
Amanda Brooks has the advice you need. Not me.
Other sources like
JJ Luna write about how to do things like get and use credit cards not tied to your name and address. I've heard
Entropay
offer 'virtual' credit cards that are not tied to your credit history,
although they can't be used with any system that requires address
verification. This could be useful even for people who are not involved
in sex work.
Resisting temptation sometimes means turning down
something you'd really like to do. The short-term gain of giving up
details for a writing prize or some immediate work may not be worth the
long-term loss of privacy. I heard about one formerly anonymous blogger
who was outed after giving their full name and address to a journalist
who asked for it when they entered a competition. File under: how not to
stay anonymous.
7. Trust your intuition.
I
have to be careful what I say here. In short, my identity became known
to a tabloid paper and someone whom I had good reason not to trust (see
item 4) gave them a lot of information about me.
When your
intuition tells you not to trust someone, LISTEN TO IT. The best
security in the world fails if someone props open a door, leaves a
letter on the table, or mentally overrides the concern that someone who
betrayed you before could do so again. People you don't trust should be
ejected from your life firmly and without compromise. A "let them down
easy" approach only prolongs any revenge they might carry out and
probably makes it worse. The irony is that as a call girl I relied on
intuition and having strong personal boundaries all the time... but
failed to carry that ability over into my private life. If there is one
thing in my life I regret, the failure to act on my intuition is it.
As an aside if you have not read
The Gift of Fear already, get it and read it.
See
also point 9: if and when you need people to help you keep the secret
don't make it people already involved in your private life.
Relationships can cloud good judgement in business decisions.
There
is a very droll saying "Two people can keep a secret if one of them is
dead." It's not wrong. I know, I know. Paranoid. Hard not to be when
journos a few years later are digging through the rubbish of folks who
met you exactly once when you were sixteen. Them's the breaks.
8. Consider the consequences of success.
If
you find yourself being offered book deals or similar, think it
through. Simply by publishing anonymously you will become a target. Some
people assume all anonymous writers "want" to be found, and the media
in particular will jump through some very interesting hurdles to "prove"
anything they write about you is in the public interest.
In
particular, if you are a sex worker, and especially if you are a sex
worker who is visible/bookable through your site, please give careful
consideration to moving out of that sphere. Even where sex for money is
legal it is still a very stigmatised activity. There are a number of
people who do not seem to have realised this, and the loss of a career
when they left the "sex-pos" bubble was probably something of a shock.
I'm not saying don't do it - but please think long and hard about the
potential this has to change your life and whether you are fully
prepared to be identified this way forever. For every
Diablo Cody there are probably dozens of
Melissa Petros.
For every Melissa Petro there are probably hundreds more people with a
sex industry past who get quietly fired and we don't ever hear from
them.
If I knew going in to the first book deal what would
happen, I probably would have said no. I'm glad I didn't by the way -
but realistically, my life was stressful enough at that point and I did
not fully understand what publishing would add to that. Not many
bloggers had mainstream books at that point (arguably none in the UK) so
I didn't have anyone else's experience to rely on. I really had no idea
about what was going to happen. The things people wrote about me then
were mainly untrue and usually horrendous. Not a lot has changed even
now. I'd be lying if I said that didn't have an emotional effect.
Writing
anonymously and being outed has happened often enough that people going
into it should consider the consequences. I'm not saying don't do it if
you risk something, but be honest with yourself about the worst
possible outcome and whether you would be okay with that.
9. Enlist professional help to get paid and sign contracts.
Having
decided to write a book, I needed an agent. The irony of being
anonymous was that while I let as few people in on it as possible, at
some point I was going to have to take a leap of faith and let in more.
Mil Millington emailed me to recommend
Patrick Walsh, saying he was one of the few people in London who can be trusted. Mil was right.
Patrick put me on to
my accountant
(who had experience of clients with, shall we say, unusual sources of
income). From there we cooked up a plan so that contracts could be
signed without my name ever gracing a piece of paper. Asking someone to
keep a secret when there's a paper trail sounds like it should be
possible but rarely is. Don't kid yourself, there is no such thing as a
unbreakable confidentiality agreement. Asking journalists and reviewers
to sign one about your book is like waving a red rag to a bull. What we
needed was a few buffers between me and the press.
With Patrick
and Michael acting as directors, a company was set up - Bizrealm. I was
not on the paperwork as a director so my name never went on file with
Companies House. Rather, with the others acting as directors, signing
necessary paperwork, etc., Patrick held a share in trust for me off of
which dividends were drawn and this is how I got paid. I may have got
some of these details wrong, by the way - keep in mind, I don't deal
with Bizrealm's day-to-day at all.
There are drawbacks to doing
things this way: you pay for someone's time, in this case the
accountant, to create and administer the company. You can not avoid tax
and lots of it. (Granted, drawing dividends is more tax-efficient, but
still.)
You have to trust a couple of people ABSOLUTELY. I'd
underline this a thousand times if I could. Michael for instance is the
one person who always knew, and continues to know, everything about my
financial and personal affairs. Even Patrick doesn't know everything.
There
are benefits though, as well. Because the money stays mainly in the
company and is not paid to me, it gets eked out over time, making tax
bills manageable, investment more constant, and keeping me from the
temptation to go mad and spend it.
I can't stress enough that you
might trust your friends and family to the ends of the earth, but they
should not be the people who do this for you. Firstly, because they can
be traced to you (they know you in a non-professional way). Secondly,
because this is a very stressful setup and you need the people handling
it to be on the ball. As great as friends and family are that is
probably not the kind of stress you want to add to your relationship. I
have heard far too many stories of sex workers and others being betrayed
by ex-partners who knew the details of their business dealings to ever
think that's a good idea.
So how do you know you can trust these
people? We've all heard stories of musicians and other artists getting
ripped off by management, right? All I can say is instinct. It would not
have been in Patrick's interest to grass me, since as my agent he took a
portion of my earnings anyway, and therefore had financial as well as
personal interest in protecting that. If he betrayed me he would also
have suffered a loss of reputation that potentially outweighed any gain.
Also, as most people who know him will agree, he's a really nice and
sane human being. Same with Michael.
If this setup sounds weirdly
paranoid, let me assure you that journalists absolutely did go to
Michael's office and ask to see the Bizrealm paperwork, and Patrick
absolutely did have people going through his bins, trying to infiltrate
his office as interns, and so on. Without the protection of being a
silent partner in the company those attempts to uncover me might have
worked.
I communicate with some writers and would-be writers who
do not seem to have agents. If you are serious about writing, and if you
are serious about staying anonymous, get an agent. Shop around, follow
your instinct, and make sure it's someone you can trust. Don't be afraid
to dump an agent, lawyer, or anyone else if you don't trust them
utterly. They're professionals and shouldn't take it personally.
10. Don't break the (tax) law.
Journalists
being interested in your identity is one thing. What you really don't
want is the police or worse, the tax man, after you. Pay your taxes and
try not to break the law if it can be helped. If you're a sex worker
blogging about it, get an accountant who has worked with sex workers
before - this is applicable even if you live somewhere sex work is not
strictly legal. Remember, Al Capone went down for tax evasion. Don't be
like Al. If you are a non-sex-work blogger who is earning money from
clickthroughs and affiliates on your site, declare this income.
In
summer 2010 the HMRC started a serious fraud investigation of me. It
has been almost two years and is only just wrapping up, with the Revenue
finally satisfied that not only did I declare (and possibly
overdeclare) my income as a call girl, but that there were no other
sources of income hidden from them. They have turned my life and
financial history upside down to discover next to nothing new about me.
This has been an expensive and tedious process. I can't even imagine
what it would have been like had I not filed the relevant forms, paid
the appropriate taxes, and most of all had an accountant to deal with
them!
Bottom line, you may be smart - I'm pretty good with
numbers myself - but people whose job it is to know about tax law,
negotiating contracts, and so on will be better at that than you are.
Let them do it. They are worth every penny.
11. Do interviews with care.
Early interviews were all conducted one of two ways: over email (encrypted) or over an IRC chatroom from an anonymising server (
I used xs4all).
This was not ideal from their point of view, and I had to coach a lot
of people in IRC which most of them had never heard of. But again, it's
worth it, since no one in the press will be as interested in protecting
your identity as you are. I hope it goes without saying, don't give out
your phone number.
12. Know when les jeux sont faits.
In November 2009 - 6 years after I first started blogging anonymously - my identity was revealed.
As has been documented elsewhere, I had
a few heads-ups that something was coming,
that it was not going to be nice, and that it was not going to go away.
We did what we could to put off the inevitable but it became clear I
only had one of two choices: let the
Mail on Sunday have first crack at running their sordid little tales, or pre-empt them.
While going to the
Sunday Times - the same paper that had forcibly outed
Zoe Margolis
a few years earlier, tried to get my details through that old Hotmail
address, and incorrectly fingered Sarah Champion as me - was perhaps not
the most sensitive choice, it was for me the right move. Patrick
recommended that we contact an interviewer who had not been a
Belle-believer: if things were going to be hard, best get that out of
the way up front.
So that is that. It's a bit odd how quickly things have changed. When I
started blogging I little imagined I would be writing books, much less
something like this. Being a kind of elder statesman of blogging (or
cantankerous old grump if you prefer) is not an entirely comfortable
position and one that is still new to me. But it is also interesting to
note how little has changed: things that worked in the early 2000s have
value today. The field expanded rapidly but the technology has not yet
changed all that much.
As before, these ideas do not constitute a
foolproof way to protect your identity. All writers - whether writing
under their own names or not - should be aware of the risks they may
incur by hitting 'publish'. I hope this post at least goes some way to
making people think about how they might be identified, and starts them
on a path of taking necessary (and in many cases straightforward)
precautions, should they choose to be anonymous.
___________________________________________________________________________________
Thanks Dr Magnanti.
Here are some hints from the EFA on
defensive technology
You might also like this from
Wikipedia about anonymous blogging
And how some bloggers
have been caught
If you have the attention of a reasonably competent state agency, then it will probably only be a short time before you are found out.
“If you wish another to keep your secret, first keep it to
yourself.”--Seneca
