Doxxing to Defend Student Privacy

on
read

(Mostly this is the sort of thing I put on my personal blog and not Hack Education, but this is too important to let slide…)

News broke late last week, thanks to Bob Braun’s Ledger, that Pearson is engaged in social media monitoring of those involved in the PARCC exams. (News flash: lots of schools, lots of corporations, lots of testing orgs are.) I’ve written at length already about the implications of surveillance of students online – for free speech, privacy, identity formation, equity, justice.

So I want to turn here to some of the suppositions and strategies that have spawned this week based on Braun’s work, particularly those purporting to defend students and schools from corporate influence.

In his initial story, Braun included a photo of an email from NJ superintendent Elizabeth Jewett. In the email, she explained her concern about Pearson’s monitoring and about the potential for parental outcry in response. It was an important revelation, I don’t mean to challenge that; but no information was redacted in the image Braun posted, so Jewett’s email, phone number (with direct extension), and office address were included – all her work details. It’s all public information, one could easily argue. I mean, it’s in her email footer!

If you were a journalist, would you redact that part of the story – the email footer? That’s a good question for the editorial desk of a newspaper. But bloggers don’t have to run through that process. No legal. No questions.

Also worth noting (and debating): for no apparent reason, Braun also included a photo of Jewett. Her name, email, phone, address, and her photo.

In a follow-up story, Braun tried to posit a connection between NJDOE commissioner Bari Anhalt-Erlichson (she penned the department’s justification of Pearson’s social media monitoring), Pearson, and MongoDB. The argument Braun makes: there’s an inherent conflict of interest as Anhalt-Erlichson’s husband works for a company whose open source database MongoDB was used by Pearson in two products (OpenClass and the National Transcript Center).

As part of his “gotcha,” Braun posted the home address of Anhalt-Erlichson, noting its property value and implying that the wealth was due to Pearson-profiteering.

When education historian Diane Ravitch picked up this story, I was mortified, in no small part because I found Braun’s story to contain many, many inaccuracies, and his arguments about the connections between officials and corporations were tenuous at best. MongoDB is an open source database, for starters, freely available for companies and developers to use. There is no proof, in Braun’s story, that Pearson had paid for support services or that there’s a financial connection between the NJDOE, MongoDB, and Pearson. None.

Warning bells for me: this was the second story in a row in which Braun had disclosed the personal information of a female edu employee of the state of New Jersey. And in this second story, it wasn’t just work info; it was a home address. Her personal details. Her "deets." Her documents. Her "dox."

Ravitch has 108,000+ followers on Twitter. She boasts 18 million pageviews on her blog. (Incidentally, I also wrote this week about the sorts of tracking mechanisms that allow her to boast about these metrics without any disclosure about what happens to visitors’ information. But that’s a different story…)

Needless to say, when Ravitch reposts and retweets a story, it matters. It resonates. It’s picked up. As such, I think she needs to be accountable for – or jeez, at least think through, the implications of the stories she reposts.

After all, doxxing relies on these sorts of large networks. Doxxing relies on amplification. So I called Ravitch out for releasing this NJDOE official’s info. Here are some of my tweets:

Here is her response:

Not her problem. Shrug.

A different response came from Mercedes Schneider, with a chillingly titled post “Doxxing: A Primer.”

I say “chillingly” here for a number of reasons, least of which being my experiences, as a woman in ed-tech, having had the ire of “the Internet” turned against me. I experienced it when I wrote critically about Codecademy. I experienced it when I wrote critically about Khan Academy. I experienced it when I wrote about harassment at ISTE. I experienced it when I wrote about Gamergate and ed-tech. Etc. Death threats. Rape threats. Harassment. Mansplaining (just a micro-aggression, sure, but my god, it wears on me and as such, undermines my work), that always tries to explain to me how I know nothing about education, technology, or any combination of the two. I’ve written about my experiences here and here. Bonus: men explained doxxing and social media monitoring to me this week.

Schneider does not name me in her post that purports to explain doxxing – there’s a lot of passive voice in describing what happened when Ravitch and Braun, to quote Schneider “were accused on Twitter of doxxing.” She does link to my twitter account – but not my individual tweets on this topic. As such I am apparently this nameless (worthless?) entity that’s challenging Ravitch, not someone with a name or a large body of work articulating the importance of privacy. Interestingly, at the very same time, Anhalt-Erlichson, by virtue of a marriage certificate and some really shoddy connections made by Braun, is worthy of being named and called out and of having her home address shared. Me, I am dismissed and erased; another woman, on the other hand, pointed to explicitly. With a call to action: she is a target; she should be punished. Me, ignored.

Since this story by Schneider was published, I have just been waiting for her mob to turn and decide to punish me. I’ve been waiting for others who loathe my work to seize this opportunity. I woke up yesterday to a bunch of Gamergate-related emails from a talk I gave last week, incidentally. I cannot even begin to describe how frightening this is. I say “I am not afraid,” and I will fight for education technology and social justice, but this ongoing bullshit makes it pretty hard. I have no institution to defend me. I have no title. I have no steady paycheck. I have no think tank, even, like Ravitch, one that I spurred. I rely on the work I do as a freelance writer, but mostly on the work I do as a public speaker. But now, increasingly, I turn down public speaking events, because I see strangers in the front row, and I fear they’re going to kill me. Today, I received a package in the mail from an address I didn’t recognize, and I cried as I opened it, wondering if it would explode.

This is what doxxing does to you.

This is what ongoing threats do to you.

This is the world in which I now operate.

I cry every day, if not because of the threats I get, because of the threats every single female friend of mind receives.

This is what you’re tapping into when you suggest that it’s really no big deal to doxx people, folks. So I have to say, Schneider’s description about doxxing is incredibly shallow, flawed, uninformed, callous.

I hate Pearson. If you know me, you know that. But I would never wish this ongoing harassment on any woman connected to Pearson. I wouldn't.

It’s publicly available information already, Schneider suggests, when she shrugs about posting Anhalt-Erlichson’s home address online. (While Braun has since removed the information from his story, Schneider links to it again in hers.) And as such, she suggests, it’s not a problem when others are pointed to that very information. That’s the argument that’s often used to sustain harassment campaigns against women: “we found it on the Internet” so it must be okay.

Schneider quotes an On the Media article from March 2014 as both her definition and her justification for doxxing’s appropriateness. It's a story in which the harassment of women is notably absent. (Only men are the targets in that story.) March 2014, for what it’s worth also pre-dates Gamergate, the ongoing campaign of harassment against women in video game development. For what it’s worth, my harassment predates Gamergate too. As does Kathy Sierra’s. As does Adria Richard’s. As does the harassment of many many folks who have angered the white, male-centered Internet communities of 4chan and Reddit and the like. We live an adjusted life. Not all of us do so with the privilege of institutional protection – in name, in status, in community, like someone like, say, Diane Ravitch.

My god, education people. Are these your allies and role models? 4chan and Reddit? Is this the path education and ed-tech wants to take?

Schneider contends that, as long as dropping the home address of someone “serves the public good,” it is acceptable, if not warranted. Commenters seem to agree. Schneider points to the recent doxxing by baseball star Curt Schilling of those who made sexist comments about his daughter and says that she would be “hard pressed to think of anyone who would reprimand Schilling for doing so.”

But see, I would. I don’t support vigilante justice, particularly without a framework that prompts us to recognize how power and privilege extends into these extra-judicial situations. Schilling isn’t just any dad defending his daughter; he’s a famous dad. Schilling isn’t just any dad; he’s a sports hero. Schilling isn’t just any dad; he’s a millionaire. Schilling isn’t just a dad; he’s a white dad – what would have happened if Trayvon Martin or Michael Brown’s dads had fought back? Schilling isn’t just any dad, he’s a gamer dad – a long time video game player and the owner of a failed video game development company, Schilling is embedded in a culture that has, as of late, been involved a deeply and violently misogynist campaign against women, a campaign that has used doxxing as one of its tools in the toolbox. I’m referring here to Gamergate, which one of the commenters on Schneider’s site suggests might be my motivation for speaking out about this.

Schneider’s post makes no mention of Gamergate. Doxxing, as she frames it, is how the powerless fights against the powerful. Indeed, doxxing is, as she puts it, “a teaching tool.”

By “teaching tool” here, I think Schneider means both a way to illustrate a particular political position and a way to “teach someone a lesson.”

In this particular case, it’s “justice” aimed against a NJDOE employee that Bob Braun has identified as an enemy. No need for more or better substantiation; no need for more information; no need for a larger community to weigh in. No jury; and no editor. Braun has alone deemed Anhalt-Erlichson corrupt through the connections he’s made on his blog. So she must be punished. Her personal data released. And we know what happens to women when we release their details this way, particularly if they’re deemed “the enemy.” Particularly if they’re deemed “the enemy” of "Internet freedom."

Yet Braun’s connections, tying Anhalt-Erlichson to Pearson, are chock full of holes. He suggests that because Pearson used MongoDB, an open source database, for at least two of its projects – OpenClass and the National Transcript Center – that Anhalt-Erlichson, by virtue of her marriage to a MongoDB exec, is corrupt and that her statement in defense of the social media monitoring of the PARCC exam, is motivated by money. There are so many flaws in Braun's argument, least of which being much of it relies on a product that was sold to Hobsons in 2013. OpenClass, the other Pearson product that uses MongoDB according to Braun, is aimed at higher education, and according to the latest assessment of the LMS market at least, used by no one, least of which being New Jersey K-12. But most importantly, MongoDB is an open source database. It is available for anyone to use for free. Pearson might pay for premium support; that is how companies like MongoDB make money off of their open source software, for sure. But there’s no record of that, particularly for contracts related to Pearson's offerings at the K-12 level in New Jersey. Pearson has ~40,000 employees, and it has significant technical expertise in-house. (I’m happy to make jokes about what that expertise looks like. Particularly if they choose MongoDB. Zing. Tech industry insider joke.) But really, doxxing someone based on technical reporting from a reporter who doesn’t know the difference between being DDOS’ed and getting a lot of traffic on his blog that uses shared hosting? Color me skeptical…

So what if Braun got it wrong? What if Anhalt-Erlichson has no direct financial connection to Pearson? I mean, what if she’s simply an official who has questionable politics with which we disagree? Are we still going to doxx her because of that? Is that now the new activism to fight "corporate education reform"?

For some, no doubt, it seems to be absolutely how politics and journalism will work in the future. I’ll point here – but I won’t link – to the work of Charles C. Johnson, a conservative blogger who doxxed the woman he claimed was at the center of that terribly flawed Rolling Stone article on an alleged gang rape at a UVA fraternity. Johnson doxxed the wrong woman.

It’s simply public record, Schneider argues. Johnson did too. The information is already available. But so are the tweets of students that Pearson is now monitoring – something that started this whole kerfuffle.

For Schneider, doxxing is not that serious. That is, it’s much like having one’s name and address and phone number in the phone book or, as Braun’s “reporting” uncovered, the property tax details of Anhalt-Erlichson. But what Braun, Schneider, and others fail to understand is how the Internet actually multiplies and concentrates access to that information. There is a big difference in having that information publicly accessible – and interesting to local real estate agents, for example – and having it broadcast across the Internet with the express purpose of having that data be used for punishment.

Because that’s what happens when you’re doxxed. Ask the young woman incorrectly identified by Charles C. Johnson. Or ask me. You get hundreds of dollars worth of pizzas delivered to your house. Oh. Ha ha ha ha. Your identity is traced to your parents, and they get hundreds of dollars of pizzas delivered to their house. Oh. Ha… Your email – you know, like the one Braun casually exposed in his original post – is subscribed to every possible newsletter, including the most horrifying pornography. Your inbox, search results for your name are filled with graphic images of you raped, dismembered, dead. Your phone is bombarded with calls. Callers threaten you with rape, dismemberment, death. Your Social Security Number is compromised. Your credit is affected, and at this point, because you’re so afraid for your physical safety, you laugh at the thought of a ding on your credit score.

When you’re doxxed, there’s a whistle: you’re now the target. Everything you do; everything you did. It’s fair game now.

Braun and Ravitch and Schneider whistled. They called out a woman for the masses on the Internet to target, to have all the data of her life pulled out, examined aggressively and maliciously. All in the service of protecting students from Pearson.

Now, thanks to Schneider’ justification that “doxxing is okay,” I wonder if we’ll see a new sort of crowdsourced harassment from these quarters. We’ve already seen folks from that circle go after women of color who worked for the teachers’ unions but who were, because of their demands for racial justice, deemed unruly.

If doxxing is the tactic – and “a primer” sure might indicate that it’s a-okay – then we have much more to do to prepare students about the implications of their online profiles, safety, surveillance, and discipline.

Seriously, we have to think about what it means when political groups decide to use social media mechanisms not just to observe and monitor but to stifle dissent and quite literally to destroy their opposition.

Written by

Audrey Watters

Published

Credits

Hack Education

The History of the Future of Education Technology

Back to Archives