Crash Override, page 8
The radical left isn’t immune to terrorizing marginalized people, either. TERFs regularly out, dox, and harass trans women because they do not consider them “real women.”
Every marker of identity multiplies not only who is willing to abuse you but how much abuse you get and how extreme it is. In Shafiqah’s words, “The people who get it the absolute worst from the internet’s human garbage are trans women of color. Every. Single. Time.”
As the lines between “real” and online life continue to blur, online abuse against marginalized people increases. When important social movements like #BlackLivesMatter start on Twitter and get carried into the mainstream, when Wikipedia attempts to collect the sum of human knowledge, and when presidential candidates run their campaigns on social media, it means that having a voice online matters—and abusers want to drive the voices they don’t like out of the conversation. Without informed and vigilant moderation and enforced Terms of Service, the conversation can become even more skewed in favor of people who already have the advantage.
So what do you do when you’re at a complete disadvantage?
After days of taking the abuse with my head down and waiting for it to pass, I decided it was time to speak out in spite of the “Stay quiet and this will all go away” advice I was getting from all but one of my colleagues. I was tired of hiding and being a punching bag for people who hated women. I was tired of how this cycle of targeting marginalized people in geek spaces seemed to endlessly perpetuate itself. I thought of the young girls and queer folks whom I’ve taught how to make their first games, and hiding felt like doing them a disservice. Silence wasn’t solving anything, so Alex and I worked together to draft a statement responding to the attacks against me and calling out the ways that they were rooted in misogyny and preexisting cultural problems.
Shaking and still semidelirious from the lack of sleep, we filled the elevator shaft with Frank Sinatra’s “My Way” on repeat. I planned on hitting the “post” button just as the chorus swelled but fucked up and had to wait for it to loop around again, nervously laughing for the first time since all this had started. I got it right the second time and felt a wave of relief. It was good to hit back, to try to call attention to these issues instead of just being beaten around by them.
But as for so many other targets of abuse before me, the backlash against me, my family, and everyone I’d ever been close to would be swift and vicious.
* I don’t want to publicize these channels and help disseminate their garbage (remember: content-neutral algorithms), so I’ll refer to them by silly names based on their personas instead. They’ve already made enough of a career off me.
* While YouTube makes money by showing you ads, Kickstarter, Indiegogo, Patreon, and other crowdfunding platforms allow fans to give money directly to whoever is doing the thing they like. This is extremely cool if you make weird stuff that doesn’t fit into traditional funding models (like me!). It’s extremely uncool when these websites aren’t great at moderating abuse.
* Two states found that sexual misconduct was the basis for 25 percent of law enforcement license revocations. Transgender people are 3.7 times more likely to experience police violence, and transgender people of color are 6 times more likely to experience police violence than white cisgender people. I could cite studies all day because they are endless—don’t send me letters telling me police bias and violence aren’t real. I will figure out what TV shows you love and send you spoilers in response.
* TERFs stands for trans-exclusionary radical feminists—transphobic people who call themselves feminists while going out of their way to hate on women. They’re a lot like Men’s Rights Activists in that way.
* It’s not irony or satire if it’s indistinguishable from the real thing. Shouting slurs at people isn’t somehow mitigated by whether you really, secretly mean it or not.
5
Cracks in My Armor
A lot of people at the center of a catastrophe find themselves saying, “I never thought it’d happen to me.” Despite having been on the internet long enough to know I should have been using strong passwords, I’d never thought anyone would bother to try to hack my accounts. Websites that asked for a complicated password had always annoyed me.… I didn’t attract much attention, so why would I bother making a password that contained uppercase letters, numbers, symbols, the painted nails emoji, two numbers that haven’t been invented yet, and one terrible secret? I set most of my accounts to “funkyfresh”* and left it at that. I protected my important accounts a bit better, sure. But for those I didn’t use frequently or that didn’t contain sensitive information… why bother?
Any relief I felt after first speaking out was short-lived. A flood of tweets screaming “FAKE! FALSE FLAG FALSE FLAG”† appeared. I clicked on one, and the message expanded to reveal that it was actually a reply to a tweet sent out from my own account—one that I didn’t recognize. I was weak from almost no food or sleep in nearly a week. Disoriented, my eyes slid off it. After a beat of confusion, I realized the mob was two steps ahead of me. I had been hacked, and someone was in control of my account, broadcasting whatever they felt like to my 17,000 Twitter followers as well as to all the creeps who had been manually lurking on my page.
Worse still, they had already mobilized to discredit me, claiming I had faked the attack on myself for attention.
I panicked, yelling to Alex to start recording everything.
Adrenaline kicked in despite my hazy delirium. My phone started ringing, but I didn’t look at it just yet—I assumed it was concerned friends reaching out to tell me I had been compromised. Messages were still being posted to my Twitter account, but they were all linking to Tumblr, where I hosted my blog. I had synced my Tumblr blog with my Twitter account to automatically tweet a link anytime I posted there. This is a common practice. That night, it worked as an open back door. Sure enough, whoever was in control of my Tumblr had changed my password, and trying to regain control was impossible without going through the platform’s support process.
In the meantime, the hacker had set my blog to automatically post anything anyone sent to a certain email address. Anyone who knew the email address could share control over my blog and make it say whatever they liked, and I couldn’t do a damn thing about it. A single insecure password on one site I barely used was all that it took to inflict maximum damage.
It only got worse from there—turns out “funkyfresh” wasn’t the kind of secure password that holds up when you have a horde of angry people trying to figure out any way into your life. Whoever had broken into my Tumblr also figured out that it had the same password as an eBay account that I’d used once to buy a pair of boots and forgotten about. The credit card tied to it was mercifully out of date, but the shipping address I’d given the seller wasn’t. The hackers weren’t just posting calls for me to die or talking about what a fat slut I was; they were sharing my personal information: my old address in Canada, cell-phone numbers from a few years back, my current cell-phone number, and my current home address. Worse still, they had posted my father’s address and phone number. And I was wrong about my ringing phone being calls from concerned friends.
They had edited the post in which I’d talked about standing my ground and not negotiating with online terrorists and replaced it with information showing that they knew where I was and where my family lived.
My phone continued to ring with calls from unknown numbers. Alex answered it once, lowering his voice, hoping that the person would think they’d gotten the wrong number and would back off. In the quiet of the tiny room, I could hear grown men on the other end, asking if I could come suck their dicks if they promised to give my game a good review or screaming their “Five Guys” meme into the receiver. Alex played dumb, but there was no point—they knew. Texts started to roll in with abusive messages; others seemed to just be trying to confirm my number. People openly discussed on Twitter what had happened when they’d called my number and, to my horror, what had happened when they’d called my dad.
I rushed to change any accounts I could think of that had the same insecure password as emails came in to my main account notifying me that people were attempting to manually reset my stronger ones. My blood turned cold as I tried to focus on the task at hand and not think about how long they’d had my passwords and what else they had been able to steal. I’d push off feeling sorry for myself till later—every second matters when thousands of people are trying to infiltrate your life.
Sometimes it was easier to flat-out delete accounts than it was to go through the tedium of changing often hard-to-wrangle privacy settings, setting a new password, verifying it, and setting up outside authentication options. It might sound trivial, but it was wrenching to delete so much of my life, like burning photo albums to make sure no one saw a private note written on the back of one photograph. In my haste, I deleted the account that hosted the award-nominated trailer I had made for Depression Quest, which I no longer had the backup for and is now gone forever.
But my safety was at stake, and I was one person racing an unknown number of obsessive strangers who at this point seemingly knew my own life better than I did.
This kind of attack is known as doxing. Doxing (named for documents, or “dox”) is the public release of someone’s private information. Some argue over what constitutes a legitimate “dox” because of how freely available personal information is online, but my personal definition is the act of publishing someone’s personal information, for which there would be a reasonable expectation of privacy, in order to intimidate or threaten.
Every account, every photo, every bit of my past became a new data point as the mob developed a detailed file on me, like freelance private investigators, and began targeting anyone in my life they thought worth harassing in the same way. Working backward from the assumption that I was deserving of everything horrible they could throw at me, they skewed every personal fact they could find through a filter that proved my guilt. This kind of investigation goes by many names: the cringe-inducing ’90s term is “cyberstalking”; GamerGate’s preferred term is “digging”; and Alex and I referred to it as “GamerGate’s Free Background Check.”
Hacked accounts are only one source of intel. We can also be our own worst enemy—a lot of people give out their information online without thinking anyone would ever possibly use it for things like this. You’ve likely given your birth date to more websites than you realize, and a home address and phone number are required to buy any website domain, with those details recorded in a public database that you have to pay money to remove yourself from.
Aside from flat-out posting your own vital information, a lot of people don’t think twice about privacy settings or what they share about their lives online, and in a perfect world, they wouldn’t have to. But in my case, photos I had posted were pored over for clues. Nonprivate friend lists or people with whom I’d publicly interacted online became potential targets if they seemed like they’d be useful to the mob.
Even if you have better internet hygiene than I did when I got hacked, you could be in a searchable public database without knowing it. An enormous industry is built around data brokerage—every piece of information about you is worth something to somebody, often advertisers. Buried in the End User License Agreements or privacy policies of most sites is a tiny clause letting you know that your information could end up elsewhere. Often this happens invisibly, with advertisers and websites tracking their traffic and user responses, but not always.
Third-party information broker sites like Spokeo are a favorite tool of doxers. These sites are like a digital white pages where anyone can search your name (often for free) and find a list of home phone numbers, known addresses, the names of family members or other residents who have lived at those addresses at the same time, and more.
Even if you somehow avoid having any information about yourself on the web, use the best passwords and security habits, and never click on any banners telling you you’re visitor number 42,069 and won a free iPad, it doesn’t mean you’re invulnerable. Social engineering, or manipulating others to release private information, is easier than ever when someone can hide behind a computer and pretend to be anyone. It takes almost no effort to make a convincing fake profile to post incriminating things that coincidentally confirm the mob’s talking points. Or to impersonate a target to approach their contacts to uncover information.
I started to get emails from previous employers asking if I had been using them as a reference for new job applications. Internet randos had been calling them, trying to get more information to use against me. I had to be concerned not only with how much information I’d put out there about myself but how much information other well-meaning people might share. I was lucky that I was staying with friends when I became a target because it made my current physical location harder to track. Most targets don’t have that luxury. Obnoxious, the alias of a hacker who habitually abused geeky women who had rejected him online, used small pieces of public data to dupe customer service representatives into giving him personal information about his targets, including passwords and other account info in addition to vital data. He used this information to terrorize his victims and their families until he was arrested, and later pled guilty to twenty-three criminal charges, including harassment, extortion, and false police reports.
The Ex wasn’t the only person willing to harness a mob to exact vengeance on me. When this started to go down, there were others who held grudges against me who saw the pitchforks and got excited. In one of the many threads that coordinated the stalking and assembling of “my file,” an anonymous poster claiming to be another ex popped in to point people to the pinup modeling I’d done under another name. Those photos were eventually stolen off a site and disseminated by the mob. I had been very careful to disconnect myself from those images, especially since I was working in an industry that already has its fair share of boob-related issues. The pictures were now plastered all over my blog; broadcast to my fans and colleagues; and individually sent to me, Alex, and my dad.
Given that these “detectives” are working backward to prove their shitty premise, there’s often incorrect information in a dox. I frequently see information about two other women who share my name included in the mob’s dossiers. If either of you is reading this, I AM SO SORRY.
Mobs never stop at just the original target and will dig into friends’ and families’ identities as well. In fact, I have never seen a dox that didn’t include someone’s family if they had any (and sometimes incorrect family members if they don’t). One of the first things I ask other people who have been targeted by online abuse is whether the mob latched on to a weird theory that they’re secretly rich, and almost every time, they ask how I could possibly have known. Through the magic of six degrees of separation, lazy Googling, and the total absence of logic, it’s easy to connect a last name or a supposed relative to someone influential or rich. Surely, it’s easier to rationalize a crusade to ruin someone’s life if you can tell yourself they’ll just go cry into their big pile of money.
Everything the “detectives” find is documented and distributed through various outlets. In my case, “megathreads” would pop up on 4chan that kept getting larger, linking to external files that had photos of me along with my personal information, screenshots of my social media accounts, images users had made to defame me, and some of their favorite abusive things that had been said to me. People would download these files, add to the cache, and reupload it, organizing all of their talking points and ammo in a centralized location.
All of this left me feeling violated and suffocated. It was hard to do anything but panic. Despite the openness of my work, I was private about a lot of my life. I had always felt like an outsider in my industry. I was self-taught and had created my first game at age twenty-four, which made me a late bloomer compared to other creators. Now I suddenly felt overexposed to the worst possible audience.
The fact that they were trying to mess with my family both infuriated and disturbed me. It’s one thing to be the target; it’s another thing to have to warn a friend or loved one that hordes of awful people are about to stalk them, too. And the rape and death threats started to feel terrifyingly real now that every conceivable detail of my life was at the mob’s disposal. Doxing and hacking may seem like problems unique to the internet, but they can quickly escalate with serious consequences offline.
It was about 3:30 a.m. when I called my dad. He was three hours ahead of me, likely already down in the Harley shop, working. He has a habit of working fourteen-hour days if nobody stops him and his health holds up. He was recovering from a heart attack but was determined to get back to work immediately. He sounded irritated when he answered the phone, then quickly relieved once he heard my voice. He confirmed that he’d been getting weird calls about me all morning and that he was none too impressed by them. Some had taken a formal tone, calling him by his full legal name, and tried to sound like they were making a legitimate inquiry. Others had just yelled or hung up.
“They keep yelling… ‘Five Guys Burgers and Lies’?” he said. My skin crawled. Those were the words crafted by an ex bent on destroying me, weaponized by vicious little turds and now repeated back to me by my father at a time when too much stress could literally kill him. I balled my fists so hard that I left tiny crescent-moon-shaped cuts on the insides of my palms.
