The illusion of anonymity: how easy it is to hunt down a troll?
"Come and find me," said the man who didn't believe it was easy to find people on the net, giving his real name. Twenty minutes later, I knew his address, university and current height and weight.
"Come find me."
Last week, I wrote a feature for a tech blog about the problem of abuse on Twitter. To recap, a number of high-profile women have been on the receiving end of some increasingly nasty abusive messages which have run the gamut from sexist slurs and angry rants to threats of rape and violence. These culminated in a series of messages to the journalists Caroline Criado-Perez, Grace Dent, India Knight and Laurie Penny among others which stated that a bomb had been placed outside each of their homes.
In my piece, I had looked at some of the practical tools that might help people, such as the proposed 'Report Abuse Button' and techniques for filtering out threatening or unpleasant messages and managing a Twitter feed when it is under attack.
The link to my piece that I posted on Twitter got a fair few retweets and I got a lot of feedback. Much was positive, some was less so and I had a few discussions with people who thought that my suggestions were unworkable and one or two who just denied that there was really a problem at all.
One chap in particular took exception to what I'd written. I'll call him Liam, although that is not his real name - he tweets under a pseudonym. Liam tweeted me to say "who actually believes these threats?! How could you put a bomb outside the home of a person you don't know. Just block."
This encapsulates two pretty common reactions to the idea of being threatened via social media. First, it's not real, it is "just words" and, second, the person doesn't really know who you are and can't physically harm you. So you should just block them and move on.
The problem with the latter approach, as I tried to suggest to Liam, is that it just doesn't scale. If you are being harassed by hundreds of people from multiple accounts, as has been the case with people like Caroline Criado-Perez, then blocking becomes more than just a chore. As Caitlin Moran put it, "If a woman is getting fifty of these messages an hour, blocking all the abusers becomes something of a thankless, full-time job."
As for the former - well, that is just wrong, isn't it? We live in public now and it could be possible for someone who wanted to carry out a threat of violence to find their victim in real life. I put this to Liam and we went back and forth for a while. "Where do I live?" he asked at one point.
I conceded that it would be more difficult to find someone like him. People like Stella Creasy and Laurie Penny tweet as themselves and have fairly public lives whereas with him there wasn't even a real name to go on.
He replied simply, giving me his real name and adding: "Come find me."
So I did. Because I realised that I was taking a lot of this on faith - the idea that we all traceable and that the dividing line between the internet and the real world is illusory. Mostly, however, I did it because he was being a cocky so-and-so and I thought it might be funny.
It took around 20 minutes. In my next reply to him I told him the town where he lived, the first 3 characters of his postcode, where he went to university and - I was showboating here - his current height and weight.
He went a bit quiet.
A few hours later he came back to me to admit, somewhat sheepishly, that I was correct and that he probably had too much information online. He has since blocked me and I can't say I blame him, really.
So, how did I do it? It was surprisingly easy. I should stress that I am not any kind of hacker. I work in and write about IT and the internet and I know my way around a UNIX box but I didn't have to breach any firewalls or tweeze open any private data vaults. At no point did ASCII characters reflect off my glasses in a darkened room while I chugged Red Bull and typed MANUAL OVERRIDE. Everything I found out about Liam was on the open web.
Facebook was the obvious starting point. I searched and then narrowed down the fifty-odd people in the UK of the same name using a process of deduction, based on other details from his Twitter feed - mostly to do with the kind of music he liked and some concerts he tweeted about attending. I also made a couple of lucky guesses that I was able to confirm by a kind of triangulation with the odd mention of him on other websites and some forum posts. His height and weight came from his rugby team's published player stats. (He's a big lad, so I definitely won't be paying him a visit.)
There was a point where I realised that I could have found out more. By paying for credits on a reverse directory site I could have found out his exact address. Doubtless, if I had been prepared to break the law and had the necessary skills I may have been able to retrieve much more personal data. Equally, if I had the law behind me and could get a court order then I might not even have needed his name to find who he was.
I was surprised by what I was able to find out but it did confirm to me that although the kind of physical threats that people like Criado-Perez et al have been getting have so far turned out to be all bluster, there is a genuine reason to be concerned that someone who is determined enough could carry them out in person.
That sense of anonymity that we feel online is largely an illusion. It is really little more than the anonymity of the herd - the sense that because we are part of a mass of people it is just too much bother for someone to seek us out.
I had no intention of travelling to [place redacted] to meet [name redacted] or to otherwise act on what I found and I was careful not to put anything too personal in my reply to him where someone else might read it.
It is likely that the quarter-wits currently sending poison-pixel messages to journalists and campaigners via social media have no plans to carry out their threats either, but this doesn’t mean that those threats have any less an impact on their targets. Even the fact that a troll or a stalker can dig up personal information about you could be very intimidating.
The one positive, perhaps, is that the police can use their greater resources to achieve the same ends. As several of the trolls tweeting threats of violence and sexual assault have discovered in the past week, it is foolish to assume that an online persona leaves no trace in the real world.