Thinking Outside the Dox: What 'consensual doxing' can teach us about internet privacy

With the Venmo debit card, you can Venmo everything. Your favorite band's merch? You can Venmo this. Or their next show? You can Venmo that. Visit venmo.me slash debit to learn more. The Venmo MasterCard is issued by the Bancorp Bank and a pursuant to license by MasterCard International Incorporated. The card may be used everywhere MasterCard is accepted. Venmo...

This episode is brought to you by Indeed. When your computer breaks, you don't wait for it to magically start working again. You fix the problem. So why wait to hire the people your company desperately needs? Use Indeed's sponsored jobs to hire top talent fast. And even better, you only pay for results. There's no need to wait. Speed up your hiring with a $75 sponsored job credit at Indeed.com slash podcast. Terms and conditions apply. WBUR Podcasts, Boston.

Hey, y'all. Before the show starts, we just want to remind you that we set up secure lines for you to communicate with us. If there's anything you need to share anonymously or very carefully. in this time that we are living. Yeah, we have a ProtonMail account. That is WBURSecureTips at Proton.me. Or you can text or call us on Signal. That number is 646-456-9095.

We should also mention that WBWAR is an NPR member station and that the CEO of NPR, Catherine Marr, chairs the board of the Signal Foundation, the nonprofit that supports the messaging app. Anyway, if there's anything you need to be in touch with us about and you want to be careful with how you share that information and protected, that's how you get in touch. WBURsecureTips at Proton.me or call us or text, signal.

646-456-9095. I wanted to start by saying I stand by everything that you found. And I'm going to take some time to spend with my family. Oh, by your family, do you mean your brother who's 10 years older than you? Or your mom who writes poems? She's found me out. So the other day I got doxxed. Doxxed as in. When someone posts your personal information online without your consent for malicious purposes. But before you get too concerned, this wasn't exactly that. Right. This doxing was consensual.

which we understand is kind of an oxymoron, but it's true. And it was done by a professional. of sorts. My name is Kristen Sotokun on TikTok. My username is notconjr and I find people's birthdays who ask and I do all of this based out of my favorite city in the world, Chicago, Illinois. Kristen, a.k.a. NotConJr, is the aforementioned professional of sorts. She's a TikTok creator who uses social media sleuthing skills to find out people's birthdays. And she shows her process step by step in...

her videos. Nobody freak out because, as Kristen says, she only finds the birthdays of people who ask her to. It's like a big game of social media hide and seek that Kristen plays with her followers. A game that she...

scrolled into a few years ago. I was a server in the city of Chicago. I have no cybersecurity background, just always have been the friend who... is the fbi of the group and i was just scrolling on tiktok and this girl posted a video and i don't i didn't follow her i didn't know who she was and she said one child guess my age

And I said, well, I don't need to guess her age. I can probably just go find it. So Kristen did what any friend group FBI agent would do and began to employ her thumb skills.

Your Instagram is posted on your TikTok profile. If you go to your Instagram, you go to your tagged photos on Instagram. Your friend tagged you in a photo of a throwback Thursday, but you're all wearing formal dresses. It's like a high school. Another trademark of Kristen's videos is how fast they go by. So we're going to break it down a little. Basically, she finds this tagged photo of the formal dresses, and she figures that this was some kind of college sorority event.

And in another post, the same friend who shared that photo shared a picture of her old driver's license with the last two digits of her birth year showing. So she was born in 1992. If she's from Florida, but she tagged the photo of all of you in Montgomery, Alabama. Bama informal dresses. I'm going to assume it was like a college event. So if you went to the same college and you were friends in college and you're the same age, you're like 30, 31. Bye.

I posted it and I went to work at the restaurant that I worked at. And then I came home and looked at my phone and I said, what? just happened. This video blew up and there was someone else who said, oh, this looks really fun. How about you try mine next? And thus, Kristen's internet niche was born.

Leish McGee says, if you can find my birthday, I'll eat my hat. I hope you're starving, Leish McGee. You turned 40 on October 31st, 2022. Oh, JD, you think because your profile picture is a truck that I won't find you. Well, guess what? My nickname is the... Happy birthday, Jays! August 29th, 1985, Haley. Okay, bye. Birthday finding has gotten Kristen over a million followers on TikTok. The series is such a hit, she's been able to become a content creator full-time.

She even accidentally added a new term. to the real world cybersecurity lexicon. So I made a playlist on my TikTok and I said, well, OK, what can I name this birthday doxing or something like that? And then I said, OK, I'll just call it consensual doxing because I'm only doing. doing it for people who ask me. I have never even said the words consensual doxing in a TikTok. I just named the playlist that.

And then all of a sudden, these news articles are coming out. These cybersecurity experts are like referring to my series, Consensual Doxing. And I said. Experts like the National Cybersecurity Alliance, which has Kristen doing live consensual doxings as part of their seminars.

Which is pretty cool when you think back to the fact that Kristen doesn't have any professional investigative or cybersecurity background. And she doesn't use any official databases or even public records to help her find people's birthdays. Those tools are pretty widely available. We journalists use stuff like that all the time. But no, all Kristen has to find her willing victims is her phone and a nosy disposition.

nosy disposition. Amory, you have another long-lost sister there? I guess so. Kristen is my gal. But anyway, we wanted to know... What can consensual doxing teach us about actual doxing and about how we might be unintentionally blowing up our own spots and each other's? I'm Ben Dox Johnson. I'm Amory Sleuth-Sievertson, and you're listening to Endless Thread. Coming to you from WBUR, Boston's NPR. Today's episode, Thinking Outside the Docks. How do you get ready to dock somebody?

I have a specific corner of my couch. It's like the good corner, you know, when you get the good corner. And I, I tell my husband, Hey, I'm. Not going to respond to anything that you say to me probably because I'm going to be locked in scrolling on someone I don't know social media for however long this takes me. And he's like, all right. It's nice you give him a warning. That's nice.

I'm curious, what's the wildest goose chase you've been on? What's the hardest one that you've ever had to do? Oh, man. I think a recent one I did was this girl who she didn't have a... picture on her TikTok. Her profile picture was just a cartoon. You want me to find your birthday, but you have a private profile? That's really tough. I'm here to destroy every single semblance of safety and security you have ever felt on the internet. Are you ready?

It was just a blonde, you know, blonde girl with glasses cartoon that looked drawn that kind of looked like it may be her. When I'm backed into a corner with info like this, the only thing to do is to Google your username. I got four results. And three were irrelevant. But one led back to TikTok. I eventually got through her friends and her college. Someone tag your username and two other people in a caption. That TikTok with that caption has this!

This photo, it's someone named Meg with glasses and blonde hair like that TikTok profile picture. And Meg is wearing a University of Pittsburgh hoodie. But I could not figure out her birthday. Meg, I looked at every single photo.

family members Facebook that you have. I am not joking. I was getting so angry because your family does post about celebrations. Is your dad on Facebook saying happy Mother's Day? Is your dad posting about you hugging a llama saying happy nine years going to camp? Here's your dad wishing himself happy birthday on Twitter.

Where's your grandma posting about you having your first horseback ride? I've watched every single volleyball video of yours on every sports website that your dad has uploaded hoping someone would say your age. They were just celebrating everything except not saying her birthday. And I knew in my heart

that this meant that her birthday had to be on a holiday because there had to be other things going on. I dug up her dad's alumni newsletter. And in the fall 2004 edition on page 60, It says that he and your mom welcomed a beautiful baby girl on December 31st. 2003 happy birthday new year's eve 2003 mcguire yeah i said your full first name i screamed when i found that one

So how long did that take you from when you started to when you were screaming with joy? I think that one took me about an hour and a half, two hours. Oh my God, that's it? She is fast and furious. I love it. I love it. And very funny. Like a natural comedian. Very funny. Natural comedic timing. Natural comedian who's blowing up your spot. A funny sleuth. Maybe she is. I would love.

for her to be my actual sister. Right. One thing that's consistent is that Kristen's challengers all seem pretty confident in their ability to elude her. And they fail every time miserably. It's amazing. She finds them anyway.

It's impressive. So impressive that Kristen's got copycats. Or should we say, copy monkeys. She kind of inspired me to do what I'm doing in my videos. Hi, I'm Jose Monkey, and I find people who ask to be found. Jose Monkey is a stage name. We're going to refer to him that way because, for right now, Jose Monkey is not interested in being found by you. Sorry.

Jose Monkey is another TikTok creator. He's also friends with Kristen, aka NotKongJr. So the copying is flattery, not theft. The participation requirements for Jose Monkey's content are similar to Kristen's. over 18, and full consent. But his methods are different. Instead of sifting through social media posts to find personal details, Jose Monkey relies on just small clues in a photo or video to find your exact location. I think we don't realize what...

an information-dense society we live in sometimes. There are always signs and bumper stickers and license plates and things like that around you that give information. One time I found someone because They were holding a very small dog. As the video opens, we can see that there's a body of water behind this person and their dog. We can see that there's what looks like a path going around the body of water.

Their video was quite difficult. We can see what looks like a port-a-potty across the way here, but I didn't think that would be too much help. Next we get a view in the other direction, and it's really just trees and grass.

It seemed like a park type area. There was like a trail and I believe there was like a dam or spillway or something like that. And guys, if that was all that there was to see here, I would have been very pessimistic about finding this place. But we've got one more clue. The dog had a rabies vaccination tag.

Toward the end of the video, I was able to see a few frames where we can make out a phone number. I quickly discovered that that phone number is associated with the DuPage County Animal Services in Illinois. So I started looking around for trails in that area. I switched to the satellite view and it didn't take me long to find this place that looked promising.

We had a path around a body of water, and when I looked on the west side, it looked like we might have something that might be that spillway that we saw in the video. Guys, that was it. You are here, near Maple Lake, on the North Central DuPage Regional Trail. in Roselle, Illinois. I surprised myself with that one. To date, Jose Monkey says he's found over 600 locations in 60 countries, which is coconuts.

Like he mentioned, Jose Monkey really strives to show you just how much we can unwittingly disclose about ourselves online. Kristen does this too, of course, but she also takes it a step further. If I'm going to go on Instagram, I'm not going to look through every single post you've ever made if you have thousands of posts. I'm going to scroll through your timeline and I'm going to see maybe you holding a balloon that has a number on it or a picture of a baby.

because that could be you as a baby. People love to post themselves as babies for their birthday. You go to tagged photos and see a picture of you by yourself because your friend would say happy birthday to you and they would only post a picture of you. So Kristen is looking at not just your posts, but also the posts of people in your social network. Right.

Because even if you don't share a lot about yourself online, your friends who love you very, very much and just want the world to know, well, they might. And speaking of people who love you very much, there's someone even more passionate about sharing your personal details on the internet.

It is always the grandmas. It's always they post a picture of their grandchildren and their friend comments. I've seen this like dozens of times. They'll post a picture and then their friend will say, oh, this is so lovely of your grandchildren. And then they will respond. and say, thanks. Lucy is 12. Judd is eight. This was in 1996 when we were staying at this lodge for Christmas. It's so crazy to me. Grandmas. Grandmas. I love a grandma. They're the best. But also, grandma, please don't post.

We've talked, I think, on the show about this before, but I keep my kids off the internet. I store my digital photos privately. I don't post them. And it's been interesting over the last almost eight years that they've been in the world. how many times their photo has been inadvertently posted and published by friends or school groups or camp. it really happens even when you're really trying hard not to let it happen

Yeah, and it's really hard to undo those posts and the spreading of that information once it's out there. And it gets awkward too, right? Like where you have to go to the person who posted the thing and you're like, hey man, I'm really sorry. You did this thing out of joy. and you wanted to share with the world this thing, but I actually prefer you didn't. Yeah. You know what I mean? Yeah. So it's not just grandma's fault. It's maybe yours for having too many friends.

There is a concept called context collapse. Casey Fiesler is an information science professor at University of Colorado Boulder. And she actually uses Kristen's videos to teach her students about context collapse. This is basically the idea that like in most people's kind of offline lives, there's not a situation in which like.

Your boss would be interacting with your grandmother, would be interacting with that girl who sat behind you in high school Spanish class. But this happens on social media a lot. Basically, imagine that your Facebook friends list is the guest list to the biggest party you've ever thrown.

And at this party, your boss, your grandmother, and that girl from Spanish class are all doing shots together and gossiping about you. Just kidding. That's a nightmare I had once, I think. Although I never took Spanish. It was Latin. Anyway. And there were no girls in Latin class, let me tell you. Oh, I was a girl in Latin class. Really? You were my girl in Latin class? Yeah. Doing shots with your grandma. Yeah.

Anyway, the party represents how social media can blur the lines between your IRL social circles, which is context collapse in a nutshell. Your grandma would probably never hang out with your boss, but online... They sort of do. And we're all used to this now. You know all these people. You added them on social media because, presumably, you want them to know a little bit about you. But what about the people in their networks?

Right, because your friends and family might share something about you to their own expansive circle of Facebook friends. And you don't have any control over what they post. You might not even know everyone who's going to see it. Which could be anyone. depending on people's privacy settings. NotCon Jr.'s videos, I think, are...

really striking examples of network privacy. And that's basically what this is. It's like privacy is not just individual, but is based on the people around you, the networks that you are part of. The big lessons are that it's usually the people around you that become the sort of failure points as related to privacy.

All social media platforms have the potential for context collapse to occur. But there is one platform in particular where NotCon Jr., Kristen, notices people making all kinds of disclosures. People treat Facebook as a private Instagram profile or a Snapchat that goes away, but Facebook is so permanent. And I think that Facebook is the least safe out of all of the apps because you can just search anything on there.

Yes, but Casey says Facebook's interface isn't solely to blame either. I don't actually think this has anything to do with the way that Facebook is. It's the... norms about how people use Facebook, which to be fair, their design has encouraged these norms, right? But the fact that people use their real name, the fact that they are prompted to share information like birth. and marital status and where they live and these sorts of things, it changes the way that people use the platform.

So Facebook's design encourages oversharing, and we sheeple humans, we oblige. Oh, God. Which makes Facebook a treasure trove of information for someone like Kristen. How exactly does she do it? We're about to find out, step by step. Yep, coming up after the break. It's time for me to get doxxed. Consensually. you On top of building this fake volcano for months, I give my daughter Smarty Pants vitamins to support her brain health so her science fair project sounds more like... and less like...

And while I may say it's not a competition, of course it's a f***ing competition. Choose Smarty Pants Vitamins to support your kid's brain health and save the science fair. Shop on Amazon, SmartyPantsVitamins.com or at Target today. This episode is brought to you by State Farm.

Knowing you could be saving money for the things you really want, like that dream house or ride, is a great feeling. That's why the State Farm Personal Price Plan can help you save when you choose to bundle home and auto. Bundling, just another way to save with a personal price plan. Prices are based on rating plans that vary by state. Coverage options are selected by the customer. Availability, amount of discounts and savings and eligibility vary by state.

So, yes, we asked Kristen, a.k.a. NotConJr, to dox Ben consensually. And not only was she up for the challenge, she, in fact, wanted to make it more challenging. I wanted to find your age only using things that you yourself have said. So I knew that I could avoid Facebook because on Facebook, I will find people's birthdays very easily.

because people will wish them happy birthday, right? So that was a no-go for me. You have an open Instagram. It is not private. Lucky for me. It's not very active either. Not very active, but it used to be active, right? And I wanted to get a general gauge of your age. And that was really helpful from a 2014 post where you said you were in Godspell in high school. It was a throwback.

That is true. Nobody gets to see those pictures. I'll say that. Oh, I've seen one. I've seen one. So you have a picture with your dad from 2014. This is love you, dad. and you post a lot about your mom and how she writes poems and things like that so I have this whole aggregate of your family I could not find any indication of your birthday. But luckily, luckily, I have all this information already. And you posted your Twitter link, excuse me, X, the everything app.

In your bio on Instagram. Yes, I did. Link in bio. Guilty as charged. And the greatest thing for me when I'm finding these birthdays is when I go to someone's ex slash Twitter and it says that they joined a long time ago. And you joined in March, 2010, because that means to me that I can look through your, I can search keywords and I'm going to find things about you. I gotta delete X.

Don't we all? Don't we all though? Yes, we really do. Yes, we do. Obviously I look up the words birthday on your profile. So on July. 28th, 2014, you said Google Doodle changed just for me. This is scary tech. And you posted a screenshot of the birthday animation that Google does on your birthday. And then you replied to someone and said, my trolling for Twitter birthday wishes totally worked. But you could be joking, right? Also, you use the word troll. So I was worried that.

you were not telling the truth or you had changed something or something like that, right? Fair, yeah. I went back to your Instagram and usually when people don't want to post about their own birthdays on Instagram, they will still post other pictures. In 2019, you posted four photos on July 29th. And all on Instagram, separate posts. What an annoying Instagram move.

But it says a lot, right? It says a lot because to me, that says you're excited about things. You wanted to share a cool thing that happened to you. I looked up July 29th, 2019. It's a Monday. So it must have meant to me, it meant you had a fun weekend. July 27th, you posted with...

three of your friends and you said met one in middle school, one at the first job, one at college and one in high school. And I said they had to be there to celebrate your birthday. But I couldn't find the year. Right. I had to go back to Twitter slash X for the year. I looked up the word. old and in 2022 May 30th, 2022, you said, I just stopped to let a couple of 10-year-olds use the crosswalk and I gave them the gnarliest hang loose this 41-year-old could muster. Oh, busted. Wow.

So with all of that put together, I'm going to guess that your birthday is 19. You are fully correct. Well played. I have to say, I was floored. Yes. I expected her to poke more fun at me than she did, considering her other videos. So I feel like she was very... It was the softest, gentlest consensual doxing, I feel, and I appreciate that. So we had a lot of fun doing this, but some people out there might not feel so warm and fuzzy about what they just heard.

Yeah, Kristen's consensual doxing videos are all very funny and lighthearted, but we live in a reality that is just a lot darker. Doxing, by definition, is a malicious act, and it can put people in real danger. That fact isn't lost on us or Kristen. People think it's fun to message me my address or they think it's fun to message me the name of my family because...

I have been doing that online. I think they missed the consensual part of my consensual doxing series. I get comments and I hope people are kidding sometimes when they say, oh, this helped me stalk my ex. Thank you so much. things like that but I like to think I'm doing more good because people who see it hopefully that makes a lot of people be more mindful of what they post online going forward.

Both Kristen and Jose Monkey, our consensual geolocator doxer, say the point of their content is not to make people stop posting entirely. They just want us to be making more intentional decisions around what we post on social media, whether it's about us or someone else in our lives. Because in our context-collapsed world... Remember that to someone else, you're the third party who's revealing their information.

And that's the thing I think I'm really taking out of this. It seems like if we can all collectively make just small changes to our own behavior on social media, we can actually keep each other a lot safer. Where do we draw the line, though? Human connection and friendship are some of the best things the internet has to offer. And some of our favorite things to talk about on this show. And some of Kristen's favorite things when she's deep diving into her Doc C's social media profiles.

I feel like I'm getting to know somebody and getting to know who they love and who they cherish. Ben, you just seem like you have a lot of people who love you and you love your family. And that's all I got. That's all I got from all of this. I didn't find anything sus. But unless you're doing sus things all over Facebook, I know nothing about that. No, no, on Reddit. He's doing them on Reddit. It is true. All of my shitposting is on Reddit. That's true. That's fair.

What does this make you think about? I mean, it makes me think about like that the internet is forever and we have to remember that because it's just like, we think of it as ephemera and we are trained to think of it as ephemera and just share with the world without really thinking. that that lasts forever and can potentially be used against us. And I don't like, just to say this, like, I don't think Kristen's point or Jose Monkey's point is to assume malintent.

You know what I mean? I'm not a believer in stranger danger as a massive problem. But being aware and being careful when you are moving through a world where there is danger. i think is valid so like i'm not saying don't be open i'm just saying be intentional right and i think that's what kristin and jose monkey are also advocating for is just like don't put the bar on the floor

when you're thinking about what to put online. Think about it. Yeah, for me, it's just like, check my privacy settings on all of my social media pages. Step one. And step two, just treat every little comment and post like anyone will find it whenever they want. Step three. Have a talk with Gram Gram. Gram Gram. All the Gram Grams of the world. Please, please stop lovingly spilling all of your family's tea on your Facebook. Start an OnlyFans account. OnlyGrams. OnlyGrams. OnlyGrams.

Endless Thread is a production of WBUR in Boston. This episode was co-hosted by me, Ben Brock Johnson, and also Amory Sebertson. It was produced by Frannie Monaghan. Mix and sound design by Emily Jankowski. Our managing producer is Samata Joshi. The show is edited by Meg Kramer. The rest of our team is Dean Russell, Grace Tatter, and production manager Paul Vykes. If you have an untold history, an unsolved mystery, or other wild story from the internet you want us to tell, hit us up.

You can email us, endlessthread at wbur.org. And I'll see you on OnlyGrams in 40 years. you