Trolling, Sexual Harassment and Murder Threats: The Dark Social Web

As if the world hasn’t had enough on its plate for the past year, it has been widely reported that online abuse and trolling has increased too, with the cybersecurity industry arguably affected more than most. Eleanor Dallaway investigates...

A few weeks back, I put out an open invite to industry to talk to me about trolling in the information security sector. The three statements above are quotes from three different people I spoke to (some who I will name, and some who have asked to remain anonymous.) 

The Cambridge Dictionary describes trolling as “the act of leaving an insulting message on the internet in order to annoy someone.” A few of the conversations I had on this topic played to this definition, but alarmingly, the majority fell into the more sinister category of harassment. 

The term trolling means different things to different people, and many agree that it’s just a different word for bullying. “It’s actually better to call it bullying as we recognize how damaging that is. We should call trolls bullies, it’s exactly the same thing but trolling has a level of kudos associated with it, yet bullying only has negative connotations.” These are the words of social engineering expert Lisa Forte, who admits that “there was a phase where I was the hottest person to troll.”

You’ll notice that the term trolling does not do justice to many of the stories you’re about to hear. 

Social media has long been a haven for the cybersecurity industry, bringing together our community in a way that makes many techies feel at home. However, a culture of trolling and worse, harassment, has emerged over time and seemingly peaked in 2020. Is this an issue unique to the information security space? No – but is there a hell of a lot of it going on in our industry? Sadly, yes. In fact, I ran a Twitter poll posing the question: Have you ever been on the receiving end of trolling/online abuse/harassment? Over half of respondents said either yes, often (12%) or yes, occasionally (43%).

In Dallas, Texas…

I’m going to introduce you to Adam. I’ve changed his name to honor his request to protect his identity. For full transparency, I’ve only heard Adam’s side of the story, so this account is based purely on what he has told me.

Adam lives in America and works in the industry. He met a woman in an online industry community and, by his own admission, “became flirty with her, as she was with me.” Adam wrote a college admission letter for her, which she used and was granted admission.

“Somehow, I was falsely accused of blackmailing her, which turned into accusations of me being a sexual predator.” It started with an accusatory tweet from someone, incredibly well-known in the industry with a large following, tweeting that a woman in the cybersecurity industry was being blackmailed by a man who was also harassing several other women. Adam wasn’t tagged in this original tweet, but comments on the post tagged him. Adam, without any evidence, was found ‘guilty’ by Twitter trial and without a single piece of proof that he had done what he was accused of, became the victim of an online witch-hunt. “It was all completely false. I publically asked for evidence and of course, there wasn’t any. People responded and told me that asking for evidence was insensitive. No-one ever asked me if I did this or if it was true.”

Adam publically declared his innocence “but it didn’t stop them attacking me. People are trying to ensure I never work in this city again. They got me kicked out of an organization I volunteer for that helps domestic violence victims. They insist they won’t show up to any industry event that I’m allowed to attend.”

Adam and I talk on the phone for 90 minutes and his anxiety and utter heartbreak about the situation is palpable. “My reputation and even my life has been threatened. I went to the police, I begged those harassing me to stop,” he tells me, his voice shaking. He recalls how his contacts, peers and even his mentor turned on him. “They saw the commotion and they blocked me. They didn’t even ask me if it was true.”

Adam has considered suing for character defamation “but the way things are in Texas, I can’t imagine a way of winning and I can’t afford the $50,000 court fee. All I want is my name cleared,” he tells me.

Over in Amsterdam…

Eden Stroet is an American cybersecurity instructor and all-round “cybersecurity nerd” living in Amsterdam with her husband who also works in the industry. She has been the victim of persistent harassment for 10 months, which all started when she refused to send nude photographs of herself to people she met in an online industry community.

On our call, Eden shares her screen with me and talks me through the folders of screenshots and collected evidence she has of the harassment. It is not for the faint-hearted. Content includes rape and murder threats; detailed written fantasies sent to her husband about raping her in front of him; fake accounts set up under her name with her (stolen) photo and her title listed as ‘sex worker;’ her wedding photos photoshopped with penises drawn on; sexist comments and sexual harassment.

On top of that, multiple (700-800) bot accounts were set up to rate her courses badly and doxing that makes her fear for her physical safety. “I can’t live my whole life in fear, but it constantly sits at the back of my mind.” Eden is the AppSec village lead at DEF CON and she and her husband have discussed a security plan for when she next has to travel for work. “We’ve talked about travelling alone, safe words, sharing location and emergency situations and ended up agreeing that he would have to attend with me.” This, she rightly declares as both necessary and an infringement of her human rights.

“I’ve reported it to IC3, I’ve reported to the police and the BADASS army. The police can’t help because the [perpetrators] are anonymous online and IC3 didn’t respond or even acknowledge my report.”

In Your Local Sainsbury’s…

Lisa Forte enjoyed a fairly non-stressful social media existence until she hit the 15,000 follower mark. “This [milestone] was the definite moment that it all exploded,” she says, explaining that the same is true for a handful of women she knows. “People think it’s fun to go for someone they perceive to be vulnerable – a youngish woman that comes over as overconfident and they think they need to give me an ego check.”

The harassment that Lisa receives ranges from sexual – she talks about a revolving door of (excuse the colloquialism) dick pics that she unwillingly receives on LinkedIn (yes, LinkedIn, the ‘professional’ networking site), the stalker pictures of her doing her weekly shop in a local supermarket she was creepily sent, to the personal and cruel attacks on anything from the way she looks to her nationality on Twitter.

She too has tried reporting to the police. While there was very little they could do, her announcement that she had taken this step gave her a six to eight week hiatus from receiving abuse or nudes, so every cloud, we agree.

To Feed or Not Feed the Troll?

Knowing how to react if you’re targeted by harassment is a bit of a minefield and is truly a very personal preference with no right or wrong answer. Melanie Ensign is an executive communications advisor in security and privacy. “My advice is to remember that not everyone’s opinion matters,” she says. “A lot of trolls are looking for a fight, so engaging them in that fight can be a positive reinforcement for that behavior.”

Melanie believes that a lot of anxiety people feel as a victim of trolling relates to concern for their reputation. “This goes back to whose opinion actually matters. You don’t need a massive fan base to be successful and it won’t have the long-term impact on your career that you think it might.”

She warns against public engagement. “The troll is looking for public validation, so keep any response off Twitter. Report it to the platform or the police, and if you send a response, do it privately,” she advises.

Melanie encourages using your tribe if you find yourself victim, but not in the way we see many do – sending their followers and networks to attack the perpetrator. This, ironically, can often segue into its own form of bullying. “Instead, use those you trust to remind you that you’re great and how insignificant the troll’s opinion is.

“As an industry, we place too much value and emphasis on social media notoriety and fame in terms of how we value each other as professionals and how we value our own self-worth,” warns Melanie.

Ed Tucker, CISO at The Workshop, agrees whole-heartedly. “We’ve put too much importance on name and personal brand.”

Ed has been known to call people out on Twitter for publicly and dramatically announcing an exit from social media, only to return a day or two later. He refers to this as “gamesmanship, playing the social media profile…it’s a lot of the ‘boy that cried wolf’ with people using drama, notoriety and sympathy as a way to get publicity.

“It annoys me because there are real sufferers of trolling, online bullying and sexual harassment and it takes away from the people genuinely suffering,” says Ed.

Ed points to the irony that an industry that bases its entire discipline on facts and evidence is so quick to jump in two-footed to a Twitter fight.

Mute. Block. Repeat

Speaking of jumping in two-footed, meet Jenny Potts, a freelance developer, cybersecurity and coding enthusiast. Jenny jumped into the cybersecurity industry two-footed, only to be subject to so much toxicity on Twitter when training to be a security engineer that she quit the industry and “went back to university as a factory reset.” Back in the industry, Jenny has  had to close her DMs due to the sexual harassment and physical violence threats she was receiving. “Trolling is funny and I can mute it, but it’s the harassment that really bothers me,” she says.

One of Jenny’s main sources of income is Ko-fi to crowdfund her security course, so shutting down her social accounts isn’t a realistic option. “How I’m feeling mentally affects my response. If I can’t deal with it, I mute or block,” Jenny explains. “For a while, I would retweet and complain about the trolling, but someone pointed out that could lead to bullying of that person.”

Jenny belongs to a Twitter group of women from the industry, all who share screenshots and advise each other on how to handle harassment. She tells me she is one of the oldest in the group (she is only 24!) and I am shocked by just how many women seem to be targeted.

“Women particularly get a lot of negative attention,” shares Lisa Ventura from the UK Cybersecurity Association. “In my experience, it comes from women bullying women too,” she says, admitting that this is even more painful.

A Female Target

Gender wasn’t even on my radar when I first decided to write about this topic, but I couldn’t help but acknowledge that three-quarters of those responding to my request to talk about this issue from the victim side came from women. Is it that women are targeted more than men? Or are women just more prepared to speak out?

Melanie Ensign believes it to be a bit of both. “Women are more prone to being trolled, but also more willing to talk about it. Women experience this type of behavior through all areas of our lives and are more attune to recognizing it.”

With the exception of only one, every woman I spoke to for this article cited that they have received sexual harassment through social media, be it regularly, occasionally or as a one-off. I question whether it has led them to consider quitting the industry.

“At times, the harassment has made me wonder what I’m doing here as I don’t feel welcome in the community,” Eden tells me, and who can blame her? Lisa Forte admits that “looking back, I wouldn’t do this again, I’d take a very different path.”

Another option I put forward to the victims is shutting down their online presence. “I’ve considered killing off my online identity, but I’ve worked hard to build a reputable brand so it’s not fair that this is my only option to stay safe,” says Eden.

Jenny has a different approach – to set up a second anonymous Twitter account “where I tweet about coding and coffee, and I get no issues with trolling on that account.” Of course, that account has far less followers and doesn’t specify that she’s a woman.

“If you’re looking to come into the information security industry, a thick skin is necessary,” concludes Lisa Ventura.

What a travesty that the online social networks that bring our industry together and offer such a source of community and support to so many can be so tragically tainted by the few.