I'm re-blogging this from Dr Brooke Magnanti's website, as she rather startingly received a threatening take-down DMCA notice for a particular blog post. As someone who is a member of ORG, I have become increasingly suspicious of the seemingly arbitrary distribution of these threatening notices. Without being a conspiracy theorist (as I am a keen skeptic too), I wouldn't be at all surprised if Brooke's mention of Tor was what got the DMCA going. Anyway, I'm happy to re-blog Brooke's article here.
How To Blog Anonymously (and how not to)
Further to yesterday's post, this is a list of thoughts prompted by a request from Linkmachinego on the topic of being an anonymous writer and blogger. Maybe not exactly a how-to (since the outcome is not guaranteed) as a post on things I did, things I should have done, and things I learned.
It's not up to me to decide if you "deserve" to be anonymous. My feeling is, if you're starting out as a writer and do not yet feel comfortable writing under your own name, that is your business and not mine. I also think sex workers should consider starting from a position of anonymity and decide later if they want to be out, please don't be naive. Statistics I made up right now show 99 out of 100 people who claim 'if you have nothing to hide you have nothing to fear' are talking out of their arses.
The items in the list fall into three general categories: internet-based, legal and real-world tips, and interpersonal. Many straddle more than one of these categories. All three are important.
This is written for a general audience because most people who blog now do not have extensive technical knowledge, they just want to write and be read. That's a good thing by the way. If you already know all of this, then great, but many people won't. Don't be sneery about their lack of prior knowledge. Bringing everyone up to speed on the technology is not the goal: clear steps you can use to help protect your identity from being discovered are.
Disclaimer: I'm no longer anonymous so these steps are clearly not airtight. Also there are other sources of information on the Web, some of which are more comprehensive and more current than my advice. I accept no responsibility for any outcome of following this advice. Please don't use it to do illegal or highly sensitive things. Also please don't use pseudonyms to be a dick. This is also a work in progress. As I remember things or particular details, I'll amend this post. If you have suggestions of things that should be added,
let me know.
1. Don't use Gmail, Yahoo, Hotmail et al. for your mail.
You will need an email address to do things like register for blog accounts, Facebook, Twitter, and more. This email will have to be something entirely separate from your "real" email addresses. There are a lot of free options out there, but be aware that sending an email from many of them also sends information in the headers that could help identify you.
When I started blogging, I set up an email address for the blog with Hotmail. Don't do this. Someone quickly pointed out the headers revealed where I worked (a very large place with lots of people and even more computers, but still more information than I was comfortable with). They suggested I use
Hushmail instead, which I still use. Hushmail has a free option (though the inbox allocation is modest), strips out headers, and worked for me.
A caveat with this: if you are, say, a sex worker working in a place where that is not legal and using Hushmail, you could be vulnerable to them handing over your details to a third party investigating crimes. If you're handling information some governments might consider embarrassing or sensitive, same. Google some alternatives: you're looking for something
secure and encrypted.
There are a few common-sense tips you can follow to make it even safer. If you have to bring people you know in real life in on the secret, don't use this email address for communicating with them even if only about matters related to your secret (and don't use your existing addresses for that either). Example: I have one address for press and general interactions, one for things related to my accountant and money, and one for communicating with my agent, publisher, and solicitor. I've also closed and opened new accounts over the years when it seems "too many" people are getting hold of a particular address. Use different passwords for each, don't make these passwords related to your personal information, and so on.
I unwisely left the Hotmail address going, and while I did not use it to send mail, I continued to read things that arrived there. That led to
this failed attempt by the Sunday Times to out me. It was an easily dodged attempt but something I would have preferred to avoid.
Over the years I have had about two email account changes every year and have changed my mobile number five times (eventually, I just stopped having one). If you change email addresses it's a good idea to send people you need to stay in contact with a mail from the old and the new address so they know it's not someone else trying to impersonate you. And to have a password so you know the response is from the right person - a password you did not exchange via an email conversation, of course.
Example: you might send an email to your editor from
old_address@somedomain.com and from
new_address@somedomain.com at the same time, and the one from new_address contains Codeword1. They respond with Codeword2, indicating they acknowledge the change.
It sounds silly, but people can and do
scam personal info all the time. Often they do so by pretending to be in on a secret so someone reveals something they did not mean to say. Play it safe. It can feel a stupidly cloak-and-dagger at first, but you soon get over it.
You can register internet domains while staying anonymous but I never did. Some people registered domains for me (people I didn't know in person). This led to a couple of instances of them receiving harassment when the press suspected they were me. In particular
Ian Shircore got a bit of unwanted attention this way.
Because all I was ever doing was a straight-up blog, not having a registered domain that I had control over was fine. Your needs may be different. I am not a good source for advice on how to do that. But just in case you might be thinking "who would bother looking there?" read about
how faux escort Alexa DiCarlo was unmasked. This is what happens when you don't cover your tracks.
2. Don't use a home internet connection, work internet connection, etc.
Email won't be the only way you might want to communicate with people. You may also want to leave comments on other blogs and so forth. Doing this and other ways of using the Web potentially exposes
your IP address, which could be unique and be used to locate you.
Even if you don't leave comments just visiting a site can leave traces behind.
Tim Ireland recently used a simple method to confirm his suspicion of who the "Tabloid Troll" twitter account belonged to. By comparing the IP address of someone who clicked on to a link going to the Bloggerheads site with the IP address of an email Dennis Rice sent, a link was made. If you go to the trouble of not using your own connection, also make sure you're not using the same connection for different identities just minutes apart. Don't mix the streams.
The timing of everything as it happened was key to why the papers did not immediately find out who I was. The
old blog started in 2003, when most press still had to explain to their audience what a blog actually was. It took a while for people to notice the writing, so the mistakes I made early on (blogging from home and work, using Hotmail) had long been corrected by the time the press became interested.
Today, no writer who aims to stay anonymous should ever assume a grace period like that. It also helped that once the press did become interested, they were so convinced not only that Belle was not really a hooker but also that she was one of their own - a previously published author or even journalist - that they never looked in the right place. If they'd just gone to a London blogmeet and asked a few questions about who had pissed off a lot of people and was fairly promiscuous, they'd have had a plausible shortlist in minutes.
After I moved from Kilburn to Putney, I was no longer using a home internet connection - something I should have done right from the beginning. I started to use internet cafes for posting and other activities as Belle. This offers some security... but be wary of using these places too often if there is a reason to think someone is actively looking for you. It's not perfect.
Also be wary if you are using a laptop or other machine provided by your workplace, or use your own laptop to log in to work servers ("work remotely"). I've not been in that situation and am not in any way an expert on
VPNs, but you may want to
start reading about it here and
do some googling for starters. As a general principle, it's probably wise not to do anything on a work laptop that could get you fired, and don't do anything that could get you fired while also connected to work remotely on your own machine.
3. There is software available that can mask your IP address. There are helpful add-ons that can block tracking software.
I didn't use this when I was anonymous, but if I was starting as an anonymous blogger now, I would
download Tor and browse the Web and check email through their tools.
If you do use Tor or other software to mask your IP address, don't then go on tweeting about where your IP address is coming from today! I've seen people do this. Discretion fail.
I also
use Ghostery now to block certain tracking scripts from web pages. You will want to look into something similar. Also useful are
Adblocker, pop-up blockers, things like that. They are simple to download and use and you might like to use them anyway even if you're not an anonymous blogger. A lot of sites track your movements and you clearly don't want that.
4. Take the usual at-home precautions.
Is your computer password-protected with a password only you know? Do you clear your browser history regularly? Use different passwords for different accounts? Threats to anonymity can come from people close to you. Log out of your blog and email accounts when you're finished using them, every time. Have a secure and remote backup of your writing. Buy a shredder and use it. Standard stuff.
Sometimes the files you send can reveal things about yourself, your computer, and so on. When sending manuscripts to my agent and editor, they were usually sent chapter by chapter as flat text files - not Word documents - with identifying data stripped. The usual method I used to get things to them was to upload to a free service that didn't require a login, such as
Sendspace. When writing articles for magaznes and papers, the text was typically appended straight into the body of the email, again avoiding attachments with potentially identifying information. This can be a little irritating... having to archive your writing separately, not altogether convenient to work on. But for the way I worked, usually not sharing content with editors until it was close to the final draft, it was fine.
When exchanging emails with my agent and editor, we never talked about actual meeting times and locations and threw a few decoy statements in, just in case. Since it has been recently revealed that
Times journalists were trying to
hack bloggers' email addresses after all, in retrospect, this seems to have been a good thing.
Another thing I would do is install a
keystroke logger on your own machine. By doing this I found out in 2004 that someone close to me was spying on me when they were left alone with my computer. In retrospect what I did about it was not the right approach. See also item 7.
5. Be careful what you post.
Are you posting photos?
Exif data can tell people, among other things, where and when a picture was taken, what it was taken with, and more. I never had call to use it because I never posted photos or sound, but am told there are loads of tools that can wipe this Exif data from your pictures (
here's one).
The content of what you post can be a giveaway as well. Are you linking to people you know in real life? Are you making in-jokes or references to things only a small group of people will know about? Don't do that.
If possible, cover your tracks. Do you have a previous blog under a known name? Are you a contributor to forums where your preferred content and writing style are well-known? Can you edit or delete these things? Good, do that.
Personally, I did not delete everything. Partly this was because the world of British weblogging was so small at the time - a few hundred popular users, maybe a couple thousand people blogging tops? - that I thought the sudden disappearance of my old blog coinciding with the appearance of an unrelated new one might be too much of a coincidence. But I did let the old site go quiet for a bit before deleting it, and edited archived entries.
Keep in mind however that
The Wayback Machine means everything you have written on the web that has been indexed still exists. And it's searchable. Someone who already has half an idea where to start looking for you won't have too much trouble finding your writing history. (UPDATE: someone alerted me that it's possible to
get your own sites off Wayback by altering the robots.txt file - and even prevent them appearing there in the first place - and to
make a formal request for removal using reasons listed here. This does not seem to apply to sites you personally have no control over unless copyright issues are involved.) If you can put one more step between them and you... do it.
6. Resist temptation to let too many people in.
If your writing goes well, people may want to meet you. They could want to buy you drinks, give you free tickets to an opening. Don't say yes. While most people are honest in their intentions, some are not. And even the ones who are may not have taken the security you have to keep your details safe. Remember, no one is as interested in protecting your anonymity as you will be.
Friends and family were almost all unaware of my secret - both the sex work and the writing. Even my best friend (A4 from the books) didn't know.
I met very few people "as" Belle. There were some who had to meet me: agent, accountant, editor. I never went to the Orion offices until after my identity became known. I met Billie Piper, Lucy Prebble, and a couple of writers during the pre-production of
Secret Diary at someone's house, but met almost no one else involved with the show.
Paul Duane and
Avril MacRory met me and were absolutely discreet. I went to the agent's office a few times but never made an appointment as Belle or in my real name. Most of the staff there had no idea who I was. Of these people who did meet me almost none knew my real name, where I lived, where I was from, my occupation. Only one (the accountant) knew all of that - explained below under point 9. And if I could have gotten away with him never seeing a copy of my passport, I damn well would have done.
The idea was that if people don't know anything they can't inadvertently give it away. I know that all of the people listed above were absolutely trustworthy. I still didn't tell them anything a journalist would have considered useful.
When I started blogging someone once commented that my blog was a "missed opportunity" because it didn't link to an agency website or any way of booking my services. Well, duh. I didn't want clients to meet me through the blog! If you are a sex worker who wants to preserve a level of pseudonymity and link your public profile to your work,
Amanda Brooks has the advice you need. Not me.
Other sources like
JJ Luna write about how to do things like get and use credit cards not tied to your name and address. I've heard
Entropay offer 'virtual' credit cards that are not tied to your credit history, although they can't be used with any system that requires address verification. This could be useful even for people who are not involved in sex work.
Resisting temptation sometimes means turning down something you'd really like to do. The short-term gain of giving up details for a writing prize or some immediate work may not be worth the long-term loss of privacy. I heard about one formerly anonymous blogger who was outed after giving their full name and address to a journalist who asked for it when they entered a competition. File under: how not to stay anonymous.
7. Trust your intuition.
I have to be careful what I say here. In short, my identity became known to a tabloid paper and someone whom I had good reason not to trust (see item 4) gave them a lot of information about me.
When your intuition tells you not to trust someone, LISTEN TO IT. The best security in the world fails if someone props open a door, leaves a letter on the table, or mentally overrides the concern that someone who betrayed you before could do so again. People you don't trust should be ejected from your life firmly and without compromise. A "let them down easy" approach only prolongs any revenge they might carry out and probably makes it worse. The irony is that as a call girl I relied on intuition and having strong personal boundaries all the time... but failed to carry that ability over into my private life. If there is one thing in my life I regret, the failure to act on my intuition is it.
As an aside if you have not read
The Gift of Fear already, get it and read it.
See also point 9: if and when you need people to help you keep the secret don't make it people already involved in your private life. Relationships can cloud good judgement in business decisions.
There is a very droll saying "Two people can keep a secret if one of them is dead." It's not wrong. I know, I know. Paranoid. Hard not to be when journos a few years later are digging through the rubbish of folks who met you exactly once when you were sixteen. Them's the breaks.
8. Consider the consequences of success.
If you find yourself being offered book deals or similar, think it through. Simply by publishing anonymously you will become a target. Some people assume all anonymous writers "want" to be found, and the media in particular will jump through some very interesting hurdles to "prove" anything they write about you is in the public interest.
In particular, if you are a sex worker, and especially if you are a sex worker who is visible/bookable through your site, please give careful consideration to moving out of that sphere. Even where sex for money is legal it is still a very stigmatised activity. There are a number of people who do not seem to have realised this, and the loss of a career when they left the "sex-pos" bubble was probably something of a shock. I'm not saying don't do it - but please think long and hard about the potential this has to change your life and whether you are fully prepared to be identified this way forever. For every
Diablo Cody there are probably dozens of
Melissa Petros. For every Melissa Petro there are probably hundreds more people with a sex industry past who get quietly fired and we don't ever hear from them.
If I knew going in to the first book deal what would happen, I probably would have said no. I'm glad I didn't by the way - but realistically, my life was stressful enough at that point and I did not fully understand what publishing would add to that. Not many bloggers had mainstream books at that point (arguably none in the UK) so I didn't have anyone else's experience to rely on. I really had no idea about what was going to happen. The things people wrote about me then were mainly untrue and usually horrendous. Not a lot has changed even now. I'd be lying if I said that didn't have an emotional effect.
Writing anonymously and being outed has happened often enough that people going into it should consider the consequences. I'm not saying don't do it if you risk something, but be honest with yourself about the worst possible outcome and whether you would be okay with that.
9. Enlist professional help to get paid and sign contracts.
Having decided to write a book, I needed an agent. The irony of being anonymous was that while I let as few people in on it as possible, at some point I was going to have to take a leap of faith and let in more.
Mil Millington emailed me to recommend
Patrick Walsh, saying he was one of the few people in London who can be trusted. Mil was right.
Patrick put me on to
my accountant (who had experience of clients with, shall we say, unusual sources of income). From there we cooked up a plan so that contracts could be signed without my name ever gracing a piece of paper. Asking someone to keep a secret when there's a paper trail sounds like it should be possible but rarely is. Don't kid yourself, there is no such thing as a unbreakable confidentiality agreement. Asking journalists and reviewers to sign one about your book is like waving a red rag to a bull. What we needed was a few buffers between me and the press.
With Patrick and Michael acting as directors, a company was set up - Bizrealm. I was not on the paperwork as a director so my name never went on file with Companies House. Rather, with the others acting as directors, signing necessary paperwork, etc., Patrick held a share in trust for me off of which dividends were drawn and this is how I got paid. I may have got some of these details wrong, by the way - keep in mind, I don't deal with Bizrealm's day-to-day at all.
There are drawbacks to doing things this way: you pay for someone's time, in this case the accountant, to create and administer the company. You can not avoid tax and lots of it. (Granted, drawing dividends is more tax-efficient, but still.) You have to trust a couple of people ABSOLUTELY. I'd underline this a thousand times if I could. Michael for instance is the one person who always knew, and continues to know, everything about my financial and personal affairs. Even Patrick doesn't know everything.
There are benefits though, as well. Because the money stays mainly in the company and is not paid to me, it gets eked out over time, making tax bills manageable, investment more constant, and keeping me from the temptation to go mad and spend it.
I can't stress enough that you might trust your friends and family to the ends of the earth, but they should not be the people who do this for you. Firstly, because they can be traced to you (they know you in a non-professional way). Secondly, because this is a very stressful setup and you need the people handling it to be on the ball. As great as friends and family are that is probably not the kind of stress you want to add to your relationship. I have heard far too many stories of sex workers and others being betrayed by ex-partners who knew the details of their business dealings to ever think that's a good idea.
So how do you know you can trust these people? We've all heard stories of musicians and other artists getting ripped off by management, right? All I can say is instinct. It would not have been in Patrick's interest to grass me, since as my agent he took a portion of my earnings anyway, and therefore had financial as well as personal interest in protecting that. If he betrayed me he would also have suffered a loss of reputation that potentially outweighed any gain. Also, as most people who know him will agree, he's a really nice and sane human being. Same with Michael.
If this setup sounds weirdly paranoid, let me assure you that journalists absolutely did go to Michael's office and ask to see the Bizrealm paperwork, and Patrick absolutely did have people going through his bins, trying to infiltrate his office as interns, and so on. Without the protection of being a silent partner in the company those attempts to uncover me might have worked.
I communicate with some writers and would-be writers who do not seem to have agents. If you are serious about writing, and if you are serious about staying anonymous, get an agent. Shop around, follow your instinct, and make sure it's someone you can trust. Don't be afraid to dump an agent, lawyer, or anyone else if you don't trust them utterly. They're professionals and shouldn't take it personally.
10. Don't break the (tax) law.
Journalists being interested in your identity is one thing. What you really don't want is the police or worse, the tax man, after you. Pay your taxes and try not to break the law if it can be helped. If you're a sex worker blogging about it, get an accountant who has worked with sex workers before - this is applicable even if you live somewhere sex work is not strictly legal. Remember, Al Capone went down for tax evasion. Don't be like Al. If you are a non-sex-work blogger who is earning money from clickthroughs and affiliates on your site, declare this income.
In summer 2010 the HMRC started a serious fraud investigation of me. It has been almost two years and is only just wrapping up, with the Revenue finally satisfied that not only did I declare (and possibly overdeclare) my income as a call girl, but that there were no other sources of income hidden from them. They have turned my life and financial history upside down to discover next to nothing new about me. This has been an expensive and tedious process. I can't even imagine what it would have been like had I not filed the relevant forms, paid the appropriate taxes, and most of all had an accountant to deal with them!
Bottom line, you may be smart - I'm pretty good with numbers myself - but people whose job it is to know about tax law, negotiating contracts, and so on will be better at that than you are. Let them do it. They are worth every penny.
11. Do interviews with care.
Early interviews were all conducted one of two ways: over email (encrypted) or over an IRC chatroom from an anonymising server (
I used xs4all). This was not ideal from their point of view, and I had to coach a lot of people in IRC which most of them had never heard of. But again, it's worth it, since no one in the press will be as interested in protecting your identity as you are. I hope it goes without saying, don't give out your phone number.
12. Know when
les jeux sont faits.
In November 2009 - 6 years after I first started blogging anonymously - my identity was revealed.
As has been documented elsewhere, I had
a few heads-ups that something was coming, that it was not going to be nice, and that it was not going to go away. We did what we could to put off the inevitable but it became clear I only had one of two choices: let the
Mail on Sunday have first crack at running their sordid little tales, or pre-empt them.
While going to the
Sunday Times - the same paper that had forcibly outed
Zoe Margolis a few years earlier, tried to get my details through that old Hotmail address, and incorrectly fingered Sarah Champion as me - was perhaps not the most sensitive choice, it was for me the right move. Patrick recommended that we contact an interviewer who had not been a Belle-believer: if things were going to be hard, best get that out of the way up front.
So that is that. It's a bit odd how quickly things have changed. When I started blogging I little imagined I would be writing books, much less something like this. Being a kind of elder statesman of blogging (or cantankerous old grump if you prefer) is not an entirely comfortable position and one that is still new to me. But it is also interesting to note how little has changed: things that worked in the early 2000s have value today. The field expanded rapidly but the technology has not yet changed all that much.
As before, these ideas do not constitute a foolproof way to protect your identity. All writers - whether writing under their own names or not - should be aware of the risks they may incur by hitting 'publish'. I hope this post at least goes some way to making people think about how they might be identified, and starts them on a path of taking necessary (and in many cases straightforward) precautions, should they choose to be anonymous.
Just in - a statement from Rupert Murdoch: "Recent allegations of phone hacking and making payments to police with respect to the News of the World are deplorable and unacceptable. I have made clear that our company must fully and proactively cooperate with the police in all investigations and that is exactly what News International has been doing and will continue to do under Rebekah Brooks' leadership. We are committed to addressing these issues fully and have taken a number of important steps to prevent them from happening again."