Facebook, trolls, temples and death threats

Hooded man I wouldn't exactly describe myself as a naïve ingénue when it comes to the risks that people can face on websites like Facebook. Security expert Graham Cluley from Sophos explains that online everyone's identity is at risk.

Indeed, last year I and some colleagues showed just how easy it was to steal identities on social networking websites after we created a fake profile of a small plastic frog called Freddi Staur (an anagram of ID Fraudster) and invited strangers to become Freddi's friend. Scores of people accepted the invitation, many revealing their full names, addresses, dates of birth, phone numbers and even - in one example - their mother's maiden name in the process.

It was therefore a surprise to me in April when I discovered that someone had, without my knowledge, stolen my very own identity on Facebook - at least in one fashion.

What happened was this. Some pumpkin-brain on Facebook thought it would be a good idea to create some controversial groups on the social-networking website and feed the flames by posting inflammatory language. So far, so normal. But what this chap also did was decide to steal an online photograph of me and use it as his profile picture.

Inevitably, someone on Facebook recognised my picture, put two and two together, made five, and announced that I must be the person posting the nonsense onto the website.  Furthermore, encouragements were posted to bombard both my own work email address and other email addresses at Sophos with 'information about what Cluley has been up to'.

All this was occurring as I was having a rather splendid holiday - with very poor internet connectivity - in Siem Reap, Cambodia.

Things got progressively nastier, as photos of me and my wife were posted to Facebook (complete with rather unflattering comments about the bushiness of my eyebrows and speculation as to where I buy my shirts). One guy, who claimed to be with the armed services, said that he had found out where my wife lived (probably not that tricky as my surname is somewhat unusual) and was considering shooting her. Another emailed me saying he intended to burn down my house.

As my wife and I were adventuring Indiana Jones-style amongst the temples of Angkor Wat at the time you can understand why we might have felt a little alarmed as to what we would find upon our return to the UK. The poor internet connectivity also made it tricky to contact the outside world, but I did file reports to Facebook asking them to delete the offending material.

Facebook's response was, I'm sad to say, mixed. Maybe I've upset them in the past with my Frog-related antics, but I would have expected them to have taken stronger action when presented with evidence of death threats on their network. Instead, Facebook advised me to contact the police and only eventually removed the photographs when I logged them as a breach of Sophos's copyright.

What is perhaps most disturbing is that not only were hotheaded internet users making death threats against me and my wife because they believed I was responsible for the troll-like postings on Facebook. There was also at least one group on Facebook which was created claiming I was a paedophile, and saying that web users could visit my site at grahamisakiddyfiddler.c**t.uk. Another group listed me as one of the 'Top 20 c**ts on Facebook.'

I'm used to being disliked for expressing my opinions on computer security - I've even had virus writers lampoon me in their malware before - but to be on the receiving end of death threats against my wife and accusations of being a child abuser takes things to a whole new level of seriousness.

It was only when a journalist published a story about my experience that Facebook finally removed all the slurs against me and my family and closed down the discussion groups that were, frankly, out of control.

To my mind, Facebook should have acted faster in my case. But I was fortunate enough to have connections in the media to make my position clear. Imagine if I had been a more vulnerable member of society, or had not been alerted to what was being said about me?

And what is Facebook doing to stop this kind of abuse happening in the first place? A quick search on their website finds literally thousands of groups with extremely inflammatory titles and highly vulgar language.

Readers with long memories may remember in 2000 that The News of the World newspaper published a 'name-and-shame' list of alleged paedophiles, which resulted in a paediatrician having her house vandalised, and innocent families asking to be rehoused as mobs descended onto the streets. It seems to me that as more people get on the internet and believe everything that they read, that the chances of mobs attacking innocent people rises all the time.

The News of the World was far from the most highbrow newspaper in the UK in the first place, but its decision to publish the names of alleged sex offenders brought it into even more disrepute.

July 2008

Blueprint for Cyber Security

Our vision is a world properly protected from cyber threat. This blueprint sets out how we can deliver that solution, starting in health and care.