There once was a time when we were in control of our identity. When we met someone we were in control of who we were to them. We could present ourselves as whatever version of ourself we chose: the intellectual, the party animal, the sports fan. We could withhold information, and the balance of probabilities was that the information we withheld would be left undiscovered.
This control of identity is something many generations have taken for granted. How could it be any other way?
The internet has changed this. No longer are our identities under our complete control.
Analytically I’ve known this for a long time. I’ve understood that the internet is forever; that no matter what Twitter or Facebook tell you about privacy settings and access control that basically you should assume whatever you put on the internet is genuinely public. I have known these facts, and I had believed I had internalised them.
I had not. In particular, what I’d not grasped is that this permanence represents a real risk to anyone who is on the weak side of a power disparity. If you’re in a minority or disadvantaged group (women, people of colour, the mentally ill), or even if you’re simply engaged in an interaction between people who aren’t equals, the data permanence of the internet becomes a weapon that can be used to threaten, intimidate and harm.
Like anyone in a privileged group (in my case white, male and middle-class), the lesson only truly set in when I accidentally found myself digging in to it. Allow me to walk you through my discovery process.
Yesterday, I was walking around Boston, being a typical tourist. I met many people: some kind, some not kind, many chatty. I had short discussions with a good 30 or 40 strangers at some point during the day.
Like any friendly discussion, a few basic bits of information featured in most of these conversations. These are things like names (usually just first names), jobs, which city people live in. Prior to the internet this information was harmless. Knowing that my name is Cory, that I live in London, and work in software, is generally useless to you without the internet. To take advantage of that knowledge to learn more about me without the internet requires huge resources and investment of time and effort that puts it beyond most casual explorers.
One person I met, in an effort to be friendly, struck up a bit of conversation. They had an unusual name, and happened to mention that they had another relative with the same name who attended a specific university. This is trivial information. Nothing of note here.
Except, as I discovered, it’s trivial to turn that information into something far more substantial. In a fit of boredom I opened Google and within 5 minutes I’d added the following bits of information that I had not been told:
- Last name
- Which university they attended
- What they studied
- Some academic works
- Family members’ names
- Partner’s name
This was so easy that it didn’t even trip my ‘holy shit this is creepy filter’. Not until I discovered an article mentioning that one of their family members had been charged with a crime did I realise how totally terrifying what I’d just done was.
Let’s be clear: that activity I just engaged in is both unethical and creepy. I believe that people should have the right to present information in a controlled way to people they don’t know. This is because information is powerful.
Consider the scenario where, rather than being myself, I were a rapist and the person I just researched was a woman I’d identified as a ‘target’. In a social interaction they have inevitably already forgotten, in which they disclosed nothing of note or problem, I was able to obtain all that information.
This is terrifying. I have no doubt that if I were to spend two hours and real effort on this task I could determine a home address for this person. I could track down friends, I could build up incriminating information. I could put myself into a situation where I can abuse the already existing power disparity, which my ‘research’ has magnified.
For those of us fortunate enough to be in a position of privilege, the openness of the internet does not represent a particular threat. This is what leads people like Chad Whitacre to propose policies of radical transparency, where organisations like Gittip will run their businesses entirely in the open. I have met and respect Chad, and I don’t believe he ever intends to put anyone at risk. But, as has been mentioned by better people than I, it’s possible that Chad’s relative privilege makes him less-able to empathise with those who are at risk: mine certainly does.
For those without the privilege (or even simply with less privilege), however, the internet represents a threat. It represents a tool that can be used to quickly obtain information you never intended for another party to possess. That information can then be used as a weapon, just as easily as it can be used for benevolent purposes.
We can try to mitigate this by talking about privacy policies, and access control, and not putting online information you wouldn’t be happy with everyone having access to. But that’s not enough.
We need a new generation of social internet services. One that reflects our mental model of social interaction: where what someone finds out about me is controlled entirely by me; where people I have not explicitly offered information to cannot see anything about me (or even that I exist); and where the social graph represents the asymmetry of human relationships.
I didn’t really understand the need for those services before. I do now. It’s time we started to make that happen. I don’t have concrete plans for this yet, but I’m going to start thinking about it from now on.
And to the person whose privacy I just unthinkingly and cruelly violated, I am so sorry. I allowed my idle curiosity to get the better of me, and it didn’t even occur to me that I had crossed a line until far too late. It was a terrible way to repay your friendliness, and I am unreservedly sorry.
Note: I have made every effort to anonymise this post to avoid having others repeat my investigation. I’ve done enough damage. I have not reached out to the individual whose privacy I violated to apologise in person, because if listening to Ashe Dryden and Shanley Kane has taught me anything it’s that violating someone’s social space in order to apologise for violating their social space is making a bad situation worse.