Meet Me at the Opsec Rave (with Imani Thompson)

0:00In allyship, people believe that visibility does some type of service to people that doesn't necessarily protect you or change your material conditions, but it does make you like super visible to people who are harming you and who seek to harm you. It's not protection.

0:17Hello, and welcome to the 4 4 Media podcast. 4 4 Media is a journalist founded company and needs your support. To subscribe, go to 44media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. You can access to that content at 404media.co. This week, I'm thrilled to be joined by Imani Thompson. Imani is a digital security trainer and host of a series of events called Catch Me Outside. Love that name so much. where she and partner organizations sometimes help people understand their personal security, divest from big tech platforms, and generally learn how to be more safe online, which is so important right now.

0:59Imani, hello. Hi. Thank you for being here. 4-4 readers probably know Imani already from our contributor Janice Rose's recent story. Janice went to one of your events in Ridgewood called 4-4 Dead Name Not Found. again amazing name not related to 404 media but such a good how could you resist um and that was like a digital self-defense workshop and you're specifically there to teach trans people how to find and remove their sensitive information sensitive information from the internet janice said the vibe is giving opsec rave happy hour just incredible incredible stuff i would love to hear just like how you got into this to begin with and a bit about your background and why you became interested in the surveillance and OPSEC world to start with.

1:48Sure. So growing up, I was a fangirl. I was like a One Direction stan on Tumblr, which I think informed our relationship to surveillance and like perasocial dynamics and the internet. I also have parents who worked in the federal government and talked about surveillance a lot like over dinner. And I studied bioethics in school and it was around Cambridge Analytica. So I studied public policy and bioethics and rhetoric. And after I finished school, I ended up being some kind of privacy analyst or compliance officer or help desk something in all of my roles. And I kind of saw gaps in my social circles as far as what I thought was common knowledge due to that background and what my friends understood technology and surveillance to operate like, but they also didn't really care to encrypt their stuff.

2:39So I kind of started being like, let's grab drinks. And I'm like, well, I have you all here. Open your phones. Let's go to settings. And that evolved into like pre-games for Dyke March, where we did digital security teach-ins and everyone open your phone and go to settings and do this and that. Let's set up advanced data protection for people who are nervous about going to Pride, especially after Trump's re-election. and over the course of the year it kind of devolved not devolved but evolved further into like raves and parties from more informal gatherings to like more social forward events i love that i love the evolution of a tumblr one direction stand to uh a digital security researcher i hope if you're listening i'm sure i mean one direction stands are working for the cia 100 % yeah I didn't I was never into One Direction I was never One Direction fangirl but you had mentioned just the the way that One Direction fangirls were like hacking into airport security cameras I didn't realize that was a thing yeah I mean you see so many stories about like little boys hacking from Roblox or whatever but I find it so much more interesting young women hacking to like look at their faves sit in a lobby somewhere.

4:00And there's no news coverage. They don't call these young girls geniuses. I don't think they're going to recruit it to the CIA. So I just wonder where they are now and how they learned that. They are doing great service for their friends, stalking exes. They're cheating boyfriends, I'm sure, yeah. Exactly. You've been hosting these events. You formalized, you know, like you said, it evolved into these more formalized events. It's still, it's pretty, you know, I don't want to make it sound like it was like suddenly corporatized, but it was like, You're actually hosting these events on purpose for people to come and do these workshops that are free for people to just show up to usually queer bars in Brooklyn and in Ridgewood and in Queens to sit down and say, okay, now open your phones.

4:39Now open your settings and let's look at what's actually going on with your phone and going on with what the internet knows about you, which these days is so much. I guess, what was your first workshop like? Did you expect people to show up? What was the theme? The first workshop I ever did was, I think, just general digital security ahead of Pride. I did two back-to-back. I did one at May and then one in June last year. And they were both pretty much, let's go through your settings. Let me explain to you what encryption is. And we'll go step-by-step through this. And the first one was literally that.

5:17The second one was we were talking about, should you bring your phone to Pride? Is it okay to do that? is it safe to do that? What's this thing, Ray? Are they real? What happens if you don't have your phone? So we made friendship bracelets that had like emergency contact numbers on the beads and lawyers phone numbers. And we like made a bunch, exchanged them. And then people are like, when are you doing this again? When are you doing this again? But people, the same people wanted to come again, but they already learned the thing. So we started doing them around interacting with ice when there was very heightened ice activity in the neighborhood where I showed people how to use a shortcuts app on an iPhone to make a little automation to say your rights out loud in different languages or to make a salute warning to send out to contacts.

6:05So I think it's like one digital security, but also demystifying technology. Something that worries me a lot is AI psychosis. And I think that that comes from people mystifying technology. And I think also So just paranoia and then pointing to the wrong things and ending up in rabbit holes also comes from not having literacy around technology to fill those gaps. So the more agency and comfort people have, I think the better off we are. And that can be from having a body double at the bar or having someone tell you that terminal is not that scary, actually, or helping you dox yourself or showing you scripting and automations in a really simple way.

6:45And then people get more creative and excited about it to do things on their own later and show their friends. So that's kind of the recurring theme throughout all of them, like agency autonomy around technology instead of divesting and running from it or shaking your fist at the sky. But usually the focus is digital security because people are concerned about that for the first time lately. Yeah, for sure. Yeah, like you said, it's been an issue for a long time. But I think now it's so much more. Yeah, it's so much more of a high profile concern. It's very immediate concern, especially like you said, with ice rates happening like in your neighborhood.

7:20It's like, what do they what do they know about me? What can they see about me from just like a Google search? And it's usually a lot. I would love to get into just like how one self-doxes because that's I don't think I mean, I haven't heard the term being used as like I'm going to actually like stalk myself basically is kind of what you're doing. I've done that before just to make sure like my stuff is locked down. And it is a weird process. But yeah, if you want to just walk us through like what is what is a self-doxing exercise typically? Sure. So we I mean, the thought is in depth as you'd imagine at home at a bar.

7:57But I think we get a good starting point. So what we do is we look up all of our PII. PII, so personal identifying information, like your phone number, your address, past addresses, your full government name, usernames that you use on other platforms or email. Googling those things, seeing what comes up using different search engines. And then doing reverse image searches of ourselves, doing the same for immediate family members too. And taking note of all those things. and then going to the tools that stalkers and employers use and going to those tools, looking ourselves up and seeing what we find.

8:34And then I spent some time explaining what data subject rights are. So the right to correct, amend, delete, to be forgotten. They're called different things in different jurisdictions, but I did an overview of what that looks like, what that means, how to exercise them. So we spent some time drafting emails to send to these companies, asking for the information to be taken down. I showed some tools that give a fill-in-the-blank version of that and how to cite the right rights to have those things deleted. And then we introduced some tools as well, like services that will automate it or do it on your behalf.

9:08But I thought that it was really important, first, for people to have the agency and literacy to read a privacy policy, to look through the privacy policy and know who to contact, to know what to say to them, and also how to find info themselves. because like there's mixed feelings about um data broker deletion sites and tools and paying for them and there's lack of access but there were some tools that sponsored memberships for attendees because it was trans day visibility which was awesome and a little bit less labor because i think i found 150 data broker sites with myself on it which would be exhausting to do alone but it's good to know that you could yeah yeah you don't because sometimes these if you can't make it to an event that's sponsored or you can't afford it on your own they are kind of expensive and it is like it's it's full-time like trying to get this stuff taken down on your own without an actual like service doing it takes forever it's it's crazy that's something that i hear a lot from i read about um the adult industry and sex work quite a bit and as you know and it was something that i'm hearing all the time from sex workers especially it's like me doing this like it's paperwork basically it's like these requests and these emails all the time to these sites that like have my stolen content or have my legal name or like have you know my mom's name takes forever and i know a lot of sex workers pay services to do like takedown requests and also to do like you said like the broker the broker stuff which has been really interesting to to learn about and to see happening over the years and how it just is has become much more of a common thing to have to do because this stuff is everywhere.

10:43And a lot of the things that we find when doing the self-doxing exercise are not things that data broker sites are going to be able to find or handle. Like we found deepfakes in CSAM doing this exercise as well. And I think like knowing how to address that, legislation's changing pretty rapidly around it, but having up-to-date information about what you do in those situations by going through legal channels or not are also things that community needs to be able to talk about together and also to not do alone. Yeah. Yeah. And I think, yeah, it's the not alone part is really important because when you're, I mean, this is just my experience, like being online.

11:22It's like when you're, you see something and you're like, I should do that later, you know, I'll do it later. But yeah, it's going back to, like you said, just like sitting down and being like, we're going to do this right now. We're going to open our phones and check it out. The great alt-range lineup of DJs. Exactly. Yeah. We're going to do it over drinks. it'll be fun I promise it's not hard or like you know it doesn't have to be miserable you can just do it with your community and also just having people around I mean do you feel like in those events people are kind of trading information as they're going they're like oh I saw this here you should check it out yes I think the one where I saw that the most was actually the de-googling party that we did for Valentine's Day we had a breakup with Google on Cash Me Outside and Cypher Collective.

12:09And like de-googling, it's not rocket science, but it is exhausting to move all yourself over, to vet alternatives. And instead of being like, okay, everyone open your laptop. Okay, next step is this. I have like a huge notion guide that I shared. And I was like, flag a facilitator down if you have questions, but people just form small groups between their turns DJing because it was OpenDex this time. And just like, oh, I like this search alternative. Oh, I like this browser. And I really liked that. I thought that was really sick. And people were telling me things about open source tools I'd never heard of, which was great.

12:47A lot of times I use these things to do things I wouldn't feel like getting around to doing myself at home. So I'm also moving over to Proton and getting my Google Drive taken out on Google Takeout with everyone else too. But I was like learning a lot and then I got to add things. Like I really hate there being a designated expert and then everyone else is a student. So I do like for these gatherings to be community building, coalition building, you know? Yeah, in the way that other people know something that somebody else might not. Yeah, like my background is privacy, which is a whole different realm from cybersecurity.

13:24So when actual technologists pull up, I'm listening, you know? Yeah, for sure. I mean, yeah, and just the community building of it all is so important because your security online is reliant on other people. I think what people maybe don't realize, and Janice touched on this on her piece, and I'm sure this is part of the process also, is when there's like a GoFundMe setup or like a cash app handle or Venmo, and that gets posted online, it feels private because maybe your real name's not on it, or there's not like identifying information on it, but people can still glean a lot of information from these crowdfunding things, which are meant to protect and support people in need, but then end up making you more vulnerable to people looking for your private information, whether it's like employers or the state or your landlord or your ex.

14:22So yeah, I mean, are people surprised when they find that out usually? Yes, I think people kind of post like everyone's business, their own business or someone else's whole life on Instagram story or in a signal group chat or whatever, because you're like, if I give all this information, you see how these compounding systems of oppression makes this person someone deserving of your money. but I don't know if it's true that giving that much information makes people care more and it does also make everyone involved targeted like I've been targeted for scams because I repost a lot of GoFundMes or because I've given money to people before and I've had people like stalkers find them from viral GoFundMe posts as well so I think like kind of observing that an unfortunate circumstance made me more aware of it but i do think when i told people these things are like and change their behaviors before something like that happens and makes them realize which i do appreciate as well like i think people say pii or personal information or sensitive information but don't define it and then everyone's nodding but behaviors aren't changing because we don't know what that means.

15:40Right. Especially outside of a work context. Yeah, for sure. Yeah. I mean, what kind of like PII are people not thinking ahead about? The same call pictures across platforms, the same usernames across platforms, Venmo handles, people, mutuals on social media, your live location on your Instagram story, like those kinds of things are sensitive and I don't think people consider that like sometimes just from talking about the weather on Twitter people can figure out where you live or local restaurants or spots or like local drama people can kind of figure out a lot about you so like not just individual data points but data points that can be combined to identify is something people don't think about because it's all in one feed right yeah for sure and I think that is That's definitely, it's something that I've had to start thinking more and more about, especially when I see it happen to other people.

16:38It's like people will be identified by, I don't know. It's just like, I'm careful about like, is my, is the window behind me showing my street? Like, is it showing a specific tree that's only on my street? It feels crazy to think that way sometimes. But people go crazy with this stuff. There was a lady at a Black Lives Matter protest in 2020, and they found her by finding her shirt on Etsy. Oh, my God. And going to the Etsy seller and then narrowing down who in this town bought this particular shirt off of Etsy. And that's how they found her and came to her house and picked her up. So it's like really like random things that can identify you.

17:21I had talked to Kalina Koltai at Bellingcat a couple weeks ago for one of these podcasts, and she was talking about how they had found a guy who was running Mr. Deepfakes, which was like the big deepfake site for like non-consensual imagery. And part of how they found where he was moving around in the world was Airbnb reviews. And they could see where he had booked Airbnbs and who had reviewed him as a guest and what hosts he had reviewed. And it's like I never leave reviews about anything good or bad for that reason. Because I don't know if someone can possibly find where I am. And that's another thing I think sex workers have talked about quite a bit.

18:04and just more people are becoming aware of, like you said, with the live location stuff, posting on Instagram, like a live story where you are at the moment is such a big, no, don't do it.

18:26This episode is sponsored by BetterHelp. Summer's here and for a lot of people, it's their favorite season. The kids are out of school or if you live in a college town like I do, the kids are all gone. It's time for vacations. It's time for fun in the sun. It's time to make sure that you don't waste this critical and wonderful time of the year. Sounds stressful, right? It's a lot to manage, figuring out where you're going to go, how you're going to pay for it all. Are you going to waste this summer? Are you wasting your downtime? Calm down. I get that. I get that anxiety spiral. Trust me. Happens to me all the time.

18:59But it's good to just take a breath and check in with yourself. And it helps if you've got someone to talk to. And that's where BetterHelp comes in. BetterHelp has quality therapists that work according to a strict code of conduct and are fully licensed in the United States. And they have a therapist match commitment. BetterHelp does the initial matching for you so you can focus on your therapy goals. There's a short questionnaire that helps you identify your needs and preferences. and they have 12 plus years of experience and are an industry-leading match fulfillment service. Meaning they typically get it right the first time, but if they don't and you're not happy, you get to switch to a different therapist at any time.

19:47You don't have to say yes to everything this summer. It's okay to take a moment and check in with yourself. Find support in therapy. Sign up and get 10 % off at betterhelp.com slash 404media. That's B-E-T-T-E-R-H-E-L-P.com slash 404Media. One of the biggest challenges with running a business today is that every problem seems to require a different tool. One website for inventory, another for email, another for chat, another for your CMS, something else for analytics. Then you have shipping, payment, customer support. Before long, you've got 20 tabs open, you have no idea where anything is, and you're pretty frustrated.

20:27That's why so many businesses end up relying on Shopify. Shopify is the commerce platform behind millions of businesses around the world and about 10 % of all ecommerce in the US. And the great thing about Shopify is that everything lives in one place. You can take tons of different apps, tons of different services and get rid of them, replace them with Shopify. Shopify has hundreds of ready-to-use storefronts. It can help you write product descriptions. It's really easy on the back end, really easy to design the front end. And if you need marketing, you can create email and social media campaigns right inside the platform.

21:00And if you need help, Shopify offers award-winning 24-7 customer support. When your business starts growing, Shopify scales with you from managing inventory to processing payments to handling international shipping. We've now done thousands of orders on Shopify for our 404 Media merch store and couldn't recommend it more. So instead of juggling a dozen different services, you can focus on what actually matters, building your business. That's why Shopify feels less like software and more like having an experienced commerce partner in your corner. Start your business today with the industry's best business partner, Shopify, and start hearing today.

21:36Sign up for your$1 per month trial today at shopify.com slash media. Go to shopify.com slash media. That's shopify.com slash media. One of the weirdest parts about getting older is realizing there are still huge parts of your parents' lives that you know almost nothing about. and time is sometimes running out. You know them as your parents, but you don't know who they were before that. What were they like at 20? What was their biggest mistake? What was the hardest decision they ever made? That's why I love StoryWorth as a Father's Day gift. Most Father's Day gifts get used for a few weeks and then disappear into a closet somewhere.

22:13StoryWorth creates something your family keeps forever. Each week, StoryWorth sends your dad a question about his life. He can answer however he wants, by email, through the web, with a voice recording, or even through a guided phone call. And I like that you can help shape the experience. You can choose from pre-written questions, write your own, or let StoryWorth generate personalized questions based on his life. The best part is that you get each story as he tells it. Then after a year, StoryWorth takes his words, photos, and memories and turns them into a beautiful hardcover book. Families have created more than 1 million books through StoryWorth, and they recently introduced an unlimited plan so you can give StoryWorth memoirs to friends and family throughout the year.

22:53I've been using StoryWorth for a few years. I gave one to my mom. I gave one to my dad. And the thing that I love most is that it asks questions that I would have never thought to ask myself. And I really like the answers that I've gotten back. It's made me feel a lot closer to my parents. So this year, give dad a gift that captures who he really is before the stories get harder to remember. Father's Day is Sunday, June 21st. Order right now and save up to$20 at storyworth.com slash 404. Save up to$20 at storyworth.com slash 404. Storyworth.com slash 404. I've realized that most style advice is way too complicated.

23:31People act like you need an entirely new wardrobe every season. But honestly, a few really good basics do most of the work for you. That's why I've been into quints. I've been remaking my wardrobe one piece at a time because they make pieces that instantly make you look more put together without feeling like they're trying too hard. For summer, I've been especially impressed by their European linen collection. I'm wearing a European linen shirt right now. I feel like I wear it during the day. Sometimes when I go out, it's great for the beach if you unbutton it. And then I also have European linen pants and shorts.

24:03So I wear those all the time. I have a flight tomorrow. I'm going to wear those on the flight. They're great. The crazy part though is the price. And that's why I keep going back to Quince. Quince offers the same kind of quality you'd expect from premium brands, but at 50 % to 80 % less because they work directly with ethical factories and cut out the middlemen. Their tees have become a go-to for me. They're soft. They fit really well. They're very sturdy. I think that they'll last a long time. And they look better than shirts that cost twice as much. So if you're like me, you'll start shopping at Quince and then you'll realize that it's not just their clothes.

24:39I have a Quince rug. I have a Quince duvet cover. I have Quince sheets. Anytime I need something around the house, I go to Quince because I know it's good quality and I know it's going to cost a lot less than other brands. I also just bought a bunch of Quince towels and I really like them. It's one of those brands where you just buy one thing and suddenly you find yourself recommending it to everyone. Elevate your summer wardrobe. Go to quince.com slash 404media for free shipping on your order and 365 day returns. now available in Canada too. That's quince.com slash 404media for free shipping and 365-day returns.

25:14quince.com slash 404media.

25:28Are people like freaked out by this sort of information when you tell them at these events? I feel like people who come to the events, they're coming with a certain knowledge. that they needed it anyway. But is the response like, whoa, I didn't realize how serious this could be? I think there's already enough alarmists. So I try not to be one. I think the reason why people avoid this education is because a lot of the people leading conversations around OPSEC are alarmist. So I really avoid that language. I don't present issues without a solution or a way to mitigate it. So I feel like people don't really leave my event scared ever, or I hope not.

26:11I haven't gotten that feedback. Yeah, 100%. You're here to DJ, to get on the decks, to listen, and to also in between things, maybe make some plans to get off of Google, for example. I mean, getting off of Google is something I think a lot more people have been doing recently, especially with the new Google changes. I mean, it feels, like you said, it's a very overwhelming process. Google takes over so much of our lives and owns so much of this software that we use every day. So divesting from Google feels like a big one, but it doesn't have to be. So yeah, what is that process like just walking folks through that?

26:45Yeah. So at the breakup with Google party, we had her Valentine's Day. We kind of started out with the baseline of people's comfort level with divesting from Google because some people need to use Google Workspace for work. Some people don't want that much friction in their lives. What have you? I think like any step people are making is a valuable one. so people can start with switching their browser their default search engine their email provider their cloud storage and we use google takeout so google takeout is a tool to just move your data off of all your emails out of your inbox your google photos google drive calendar contacts everything you can have those sent to and zip files within a few hours and people did that moves it over to Proton because Proton kind of has an equivalent for most of the major Google tools and their UX is pretty similar too.

27:44So we did that. We had people compare different alternatives to the search engines. There are a ton on Search Party. So people can kind of find one that resonates with them. There has to be at least one because there's so many alternatives to Google, especially now that they have this Gemini thing that they're tripling down on. It's becoming less and less usable. So switching your search engines, it could start as well. But there are some people who want like a graphene pixel phone as well, who are a bit more full throttle with it. And there are a lot of resources for them too. But I think it's cool to all be in the same space doing whatever it is that we want to do.