What does seeking privacy look like from the inside?

Or, the good kind of data harvesting

So this week we have something a little bit special. Normally I pick a topic at the intersection of privacy and psychology and explore some of the research and my thoughts on it. But when I was kicking around how I’d approach the idea of mental health and privacy, I happened to see a few people within a couple of days of each other talking about how their privacy journey had caused serious mental health issues in them and how they were going to have to re-evaluate their approach and that. And several of them were very kind and consented to sharing their views with me for the purposes of this blog post!

Disclaimer Time

Just a quick note, all people will be assigned pseudonyms (not that I know their real names anyway), and have all seen what sections of what they told me I’m sharing. I didn’t ask any identifying questions, and I carefully read what they said so I don’t think there’s any identifying characteristics in there. I don’t know their genders or countries or even their native language. Pseudonyms have been assigned more-or-less randomly by me for ease of identifying the speaker. I don’t know their genders, so I make no guarantees that the genders associated with the names matches their actual genders. Also, when editing, if I added or changed a word (usually due to fixing a typo), I put it in brackets [like this].

In addition to that, this was not a formal interview, and while I asked follow-up questions to try to understand what they said, I did not necessarily perfectly capture the full context they were coming from. Nor did I do a formal qualitative analysis of what they said (although I do hope to do basically that in a formalised form in the next few months!), this is a more informal eyeball-and-summarise. In addition, I make no claims that this sample is at all representative, this is what we call a “convenience sample”. So while I think what I present here is broadly correct, please do not take this as gospel for all people at all times in all contexts. Instead, I will be using these viewpoints as a jumping-off point to talk about some dynamics that might be present to some extent for some people’s privacy journey.

Difficulty in threat modelling

One common element of the people I spoke to was they all expressed what amounted to a difficulty in judging how much cost (be that effort, inconvenience, monetary or otherwise) was justified by their threat models. Ilene said:

I made it quite difficult to complete my college work and I annoyed people around me constantly. I also isolated myself a lot and of course I wouldn't use any dating apps, Facebook, anything like that because they're terrible for privacy... I think that all-or-nothing approach really damaged me mentally and emotionally and I'm still trying to recover from it … Just the annoyance of software not working and having to constantly find workarounds for that, having to generate a fake name and address every time I made a digital purchase, always keeping airplane mode on except when I needed to take a call, having to log into my VOIP service so I can accept 2FA texts, trying to convince people to use Signal to contact me, it just got to be a lot to deal with after a while.

Katharine had a similar story:

In search for ultimate privacy I would isolate myself from common social interactions and the gains [were] not that significant, because I wouldn't study privacy in depth to actually be as private as possible. It was better for privacy to abstain from all the platforms, but at the cost of my social circle.

Julian also noted issues with isolation. When speaking about the role of privacy-oriented social spaces, they noted that:

They give a sense of "not alone"-ness…There [are a] few good folks who understands needs and [a] few other[s] who'll insist that tor with 7 proxies is the only way to be private.

Robby noted a similar concern with balancing the demands of life with privacy:

Often I find myself taking much longer doing things due to privacy protections and even then often I end up having to take a not so private route anyway … This not only takes up valuable time I could be doing other things but has a toll on me mentally, often I can end up annoyed or anxious at the end of it. I have even avoided doing certain things due to privacy concerns, affecting and contributing to the breakdown of relationships that were important to me.

For all of them, this seemed to derive from difficulty in threat modelling. Julian described it thus:

Started with the loose "I have to be as private as possible" and now I'm still in the process of figuring my thread model as some privacy invasive services do give me value… One thing I did was reevaluate what I need to be doing.

Katharine noted a similar history:

I took a personal vibe approach, do whatever feels better but then don’t overdo it as the social part is important. So at the end I would stay in most platforms but with a careful approach … I started fully open, then fully closed, then a balanced approach, and now I am in a place where I am active in both worlds. I maintain a carefully executed social life in non privacy platforms, but in parallel I maintain presence in privacy/libre alternatives with a nickname!

Ilene reported trying to construct a more formal, structured threat model:

I didn't initially, it was mostly just "I need all the privacy!!!!" and I got to a point where I had difficulty doing my college assignments sometimes because I was running Linux and I needed Windows software … I tried to sit down and actually figure out what I want to defend against but I really ended up with the same loose "vibe" approach just much more lax … You have to think about what you want privacy from, like you might want privacy from your roommate rather than Google. Things that achieve that goal wouldn't necessarily make you more private from the NSA or whatever.

Looking at these, it’s tempting to attribute their “excesses” with a vague threat model, and I do think there’s some value there. Ilene notes that explicitly, and that kind of realistic examination and reflection is something I definitely advocate for. But it’s important to note that the world is complicated and ever-changing, and the formal/vibe dimension doesn’t address the difficulty in judging the severity of one’s threat model. Although none of the respondents described themselves as taking a structured approach, it’s easy to imagine people who have a very structured but excessively extreme approach. So I don’t think it’s that simple. Robby even noted that learning – something I’m obviously in favour of, and also something absolutely crucial to a structured threat model – was a two-sided coin:

“As my understanding and knowledge of privacy invasions, technology and methods grew I increased the amount I would implement, often implementing difficult and disruptive techniques, some of which have paid off but some which have likely caused more disruption than needed.”

Creating a threat model is something that an average person isn’t going to be knowledgeable about, and searching for help is… less than useful. There’s a couple of guides which try to help, but at the end of the day answering questions like “How much does it matter if Google knows what kinds of videos I like to watch?” or “How much am I willing to sacrifice to prevent Facebook knowing my phone number?” is ultimately going to be individual and dynamic, with potentially significant opportunity cost. And given the ability of information to be stored and later correlated incentivises more extreme measures over less – if the government changes the law next year to outlaw playing go, for example, I’d be much happier if I kept my hobbies private than otherwise.

Analogies to burglary or physical attacks also don’t help – although conceptually useful, emotionally the idea of someone breaking into your house is very frightening, so would elicit more protective cognitions than a more neutral example. Add in the dynamic and often-hidden nature of corporate and government surveillance and this is a very hard space to come up with a structure to work within when making decisions. In that context, reliance on more loose heuristics is entirely justifiable.

For example, I have a general heuristic that Facebook is super-hinky, so I’m very unlikely to trust anything they do without very compelling evidence otherwise. This means I save a lot of effort having to do detailed risk analyses of the latest Facebook product which might add some value to my life. The cost is that I do risk skewing towards my pre-existing biases – let’s say a miracle occurs and Facebook suddenly starts being privacy-respecting (and somehow doesn’t go bankrupt in a week). I would very likely miss out on a lot of potentially useful services or benefits, and it could easily take a long time for me to appropriately update my biases. Alternatively, these emotional vibes are really easy to manipulate, as I talked about a while ago.

This is basically what Katharine and Ilene and Julian and Robby experienced, the only difference being the degree of evidence of hinkiness. And given the existence of things like honey-traps and privacy-washing, it’s not particularly clear where the line of reasonableness is!

So, in short, poor threat modelling can cause a lot of problems, but threat modelling is really, really hard, and the costs for getting it wrong skew heavily. This is part of why a lot of people’s privacy journeys involve a stage of going too far – that is, incurring more cost than warranted – before finding their individual sweet spot, including mine.

Social effects

We touched on this above, but I think this is worth examining in itself in some detail. Another common element was the social aspect of privacy. There’s the obvious direct impact – it’s hard to communicate with people privately if people insist on using non-private methods, for example – but there’s also the broader effect of “people viewing caring about privacy as being kind of weird”, or what we call “nonconformity”.

Ilene described the response of their family:

They did not react well at all, my mom thought I was a drug dealer or something because I wanted them to use Signal.

Katharine noted a similar dynamic:

My friends [were] negative to the privacy craze and all the alternatives. My family [were] sceptical.

While Robby described something I can definitely relate to:

Often when taking steps to ensure my privacy I am seen as paranoid, even ones which have no effect on other people.

Julian, for reference, noted a more neutral response:

It was mostly an individual journey but [a] few show a [shocked] reactions when [they] search and it isn't Google.

There’s a whole bunch of research with potential perspectives on this effect including the findings that people who are more socially isolated actually end up perceiving the world as more threatening, which promises an unpleasant feedback loop. For now I want to talk about “magical thinking”.

Magical thinking is both more and less interesting than you might think. Alas, it does not actually allow us to affect reality with our thoughts, but instead refers to the belief (usually not consciously held) that our thinking somehow creates our reality. Not in a “how we think about things affects our experience of reality” way, but in a “pointing out existing phenomenon wills that into existence, or at least substantially increases its commonality” way. You sometimes see this in OCD, where people have this idea where the rituals (which in fact have the purpose of managing anxiety or panic) will somehow prevent the obsessed idea (which are in fact semi-random things that pre-existing anxiety latch onto) from coming to pass; I count the number of times I chew my food in order to prevent my house from burning down, for example. Both of these aspects can be viewed as a form of magical thinking; the person can probably admit that the thoughts don’t literally create reality (depending on their level of insight), but they still have this deep feeling of truth, which tends to have a larger impact on our actual behaviour and beliefs than we usually like to admit.

In this case, part of what Katharine noted was people seeing that they were taking statistically unusual steps to protect their privacy, and when they asked Katharine probably pointed out some of the ways in which our data is harvested without our knowledge or consent. This, quite reasonably, made them anxious. But when you are confronted with a situation that causes you anxiety, you have two main options:

1. Start trying to mitigate that through addressing the problem, what we call “problem-focused coping”. In this context, by identifying where data is being harvested that you care about, and trying to mitigate that proportionately to the severity of the problem by using Tor or web extensions or whatever.

2. Start trying to mitigate the anxiety, or “emotion-focused coping”. Basically you don’t necessarily address the problem, but instead the emotions related to it. This can come off as bad or superficial, but sometimes you flat-out can’t address the problem (I can’t ultimately change the fact that the people I love will someday die), or your emotions are preventing you from doing so; I can’t deal with the spider if I’m having a massive panic attack, so I need to calm down first before I find the can of bug spray and asphyxiate half the house.

Then there is what I’ll call 2a; address the emotional side of the problem through claiming that the problem-focused coping behaviours (spraying the spider with just way too much bug spray) are somehow creating or exacerbating the problems causing the anxiety (there being spiders around), therefore the correct thing to do is to ignore it as much as possible, and shout down the people who keep bringing it up.

If my favourite coffee shop regularly donates large amounts of money and resources to a puppy-kicking group, and I like puppies, then I am, in some sense, supporting the kicking of puppies, which contradicts my sense of myself as someone who likes puppies. This creates cognitive and emotional dissonance, which we don’t tend to like very much. Normally, we can ignore this (I know factory farming is horrific, but I like meat and eggs and milk, so I very carefully don’t think about it, for example). But if Bob keeps talking about it, then I can’t just ignore it. Maybe I can ignore Bob (unfollow him on social media, stop inviting him out for coffee, whatever), but sometimes I can’t. Maybe Bob is a co-worker, or a member of my family, or there’s hundreds of Bobs and they’re all talking about it. So I need a more active solution.

I could stop going to the coffee shop, and thus absolve myself of my involvement in future issues, but maybe the next one isn’t very good, or it’s expensive, or it’s further away, or my friends all go to the first one, or whatever. Even then, I might feel responsible for my support given when I didn’t know. In that case, I need to go further. I could join Bob, maybe try to get the coffee shop/puppy kickers shut down, but honestly that’s a lot of work and might create even more social isolation, especially if Bob is a member of my social out-group. Or… I could make Bob shut up. I could shout back that the puppy-kicking group creates demand for puppies, which creates more puppies to exist even if some of them might suffer, which is transparently a good thing, so Bob is actually an awful human being and should be kicked off social media/fired/locked up/whatever. Or I might argue that puppies like being kicked, it was their purpose for being. Or whatever, the argument in question isn’t the point, the goal is to make Bob shut up so I feel better. All of these also have the nice bonus of making me feel righteously angry, which is a really good way to (temporarily) silence shame or guilt.

Laid out like that, that is obviously foolish at best, but it’s common.

This is, I believe, part of why simply telling people about privacy-violating stuff is a mixed bag. If you’re told that Google regularly tracks you around the internet and spends huge amounts of time and money to know more and more details about your private life in order to sell that information, that’s pretty alarming. But if you can’t pull away from Google – say your work makes you use GMail and/or have privacy-violating apps on your personal phone – then you’re in a lousy situation. Realistically you can’t avoid that problem, and you really can’t make Google less lousy. You’re going to be anxious all the time, and some – not all, not even most – people are going to choose option 2a.

Does this mean we shouldn’t tell people? Oh, no, absolutely not. But it does mean we have to walk a fine line between making people aware of their context and how they can mitigate it (even if only marginally), and not forcing them into self-protective lashing out.

Mental health

Again, we saw this touched on in the first section, but this is something I really want to focus on; the mental health impacts of privacy. Because while we don’t like to talk about it, there are substantial costs and risks to spending your time thinking about how powerful entities are spending billions of dollars to spy on you and try to control your behaviour (even if that control is to sell toothpaste). It’s easy to view that as a threat to your safety or autonomy, and unless you get seriously extreme, you’re not going to be able to completely remove the data harvesting (although you can reduce it substantially). And every minute you spend educating yourself about the latest Google tracking system or hacker vulnerability or government surveillance is a minute spend living with that anxiety, and chipping away at the basic social trust we need to function.

Nate at The New Oil made a post recently where he talked about how one of the biggest threats to your privacy can be your friends and family. You have a barbeque with your family, someone takes photos, and uploads them to Facebook. Unless they’re careful, Facebook now knows where the barbeque took place, when, and with facial recognition software knows who was there, what they ate, what games were played, and more. Nate went on to talk about the importance of setting and keeping good, sensible boundaries with people, and that’s important.

But it’s not hard to see how someone who is maybe on the borderline could fall off and become more socially isolated due to fear of someone’s carelessness. I have a friend (Peter) who has an Alexa, and I go to his place periodically for gaming and hanging out. Is the Alexa listening to what we say, noting our voices and storing it away in Amazon’s vault? Probably, they’ve done it before although it appears as if they’ve stopped it now. Even if intellectually I know I have no evidence that the Alexa is listening, I’ll admit it makes me pretty uncomfortable to know it’s there. If I were more prone to anxiety or paranoia, I can totally see myself not wanting to go around there any more, or asking Peter to turn it off.

To be clear, I’m in no way saying that Nate’s post will cause anyone to become more paranoid. I have no reason to think that. I’m simply using the post to illustrate how greater awareness of others being less private than us can create difficulties in maintaining relationships with them.

Katharine, Robby and Ilene all noted becoming more isolated and anxious as a result of becoming more concerned with their individual privacy. Robby even noted privacy burnout as a problem:

I think often this has also caused me to reach burnout and so forgetting to keep up with the news about privacy and security.

Ilene noted a similar dynamic:

The annoyance of software not working and having to constantly find workarounds for that, having to generate a fake name and address every time I made a digital purchase, always keeping airplane mode on except when I needed to take a call, having to log into my VOIP service so I can accept 2FA texts, trying to convince people to use Signal to contact me, it just got to be a lot to deal with after a while.

Now it’s really easy to say “oh, that’s not being concerned with privacy that’s the problem there, it’s because we live in such a non-privacy-respecting system!” And yes, that’s true, but that is the system we work within and I don’t see it changing anytime soon. It’s true but irrelevant to any pragmatic approach. Sure, go for advocacy and activism to try to change things, that’s a fantastic idea and totally something worth doing, but even the best activist organisation in the entire world isn’t going to change it by next week, or even next year.

This isn’t a new observation to me. Michael Bazzel talked about what he called “extreme privacy fatigue”, Techlore did a really good video about some of the mental health issues faced by privacy advocates, and The New Oil touched on this in a post about improving your privacy skills over time. Actually, I’m going to quote that post:

In the past, I’ve mentioned threat modeling and not overloading yourself. That stuff still applies. It’s still critical that you don’t burn yourself out or run yourself into a mental hospital (no stigma intended) because you tried to emigrate to a country with better privacy laws when you didn’t have to … We all have a set amount of stuff we can deal with in a day. Some people call it “spoons,” I call it “emotional bandwidth,” but at the end of the day it’s the same thing: we have a limit on what we’re capable of. This is usually a combination of decisions, physical effort, emotional attention, etc. but once we’re out, we’re out.

While there’s no One True Source of mental dysfunctions, one way of thinking about them is the diathesis-stress model. Essentially, it posits that an individual has a certain pre-disposition to developing some kind of dysfunction due to a combination of genetic make-up, long-term health factors, temperament, environment and others. And when the individual experiences the right amount of the right kind of stress, this leads to certain kinds of dysfunction forming/manifesting.

I like to think of it using bones as a metaphor. I have a particular weakness of the bone in my arm. It’s fine for compression and stretching and twisting, but has a greater weakness if force is applied from a particular angle. So if someone were to hit me with a baseball bat from that angle, I would be more likely to have it break than someone else. It’s not that I have “weaker bones” in a global sense, but for various reasons that particular kind of force from that particular angle affects me differently. Someone else might be more vulnerable than average to twisting force, or compression force, or in a different place. Nobody has unbreakable bones – which would be bad in both a metaphorical (it’s necessary and desirable to react to stress, because it indicates something is wrong) and literal (osteopetrosis is a rare but potentially serious condition) sense here – it’s just a question of how much of what kind of stress triggers what kind of dysfunction.

In this context, frequently being confronted with/thinking about certain types of threats, and taking steps to protect against these threats, can act as a pretty serious stress. It can trigger a kind of chronic anxiety, or even bring out latent paranoid traits, which can obviously build to potentially serious levels, and have a tendency to form a feedback loop (paranoid people tend to be more stressed, which creates more paranoia).

Again, this does not necessarily mean that paying attention to privacy is bad or unhealthy. I obviously don’t think that. But it does mean that we need to pay attention to the mental health side of things and how our attempts to protect our privacy affects us. As Katharine noted:

I would like to notice that it is of most [importance] to check your mental status and seek the proper help if you feel you are overly [mis-using] the internet or if you are too private. Mental health may affect how you use the internet!

Summing up

So, what have we covered here?

A vague, vibes-based threat model can be prone to expansion, leading to undue burdens and stress, but a more informed/structured one can also do the same thing. In addition, given the potentially significant opportunity costs and effort involved, threat models naturally bias towards being more extreme than less, and it’s not necessarily obvious how to work around this in a principled fashion.

Being concerned with privacy can create social isolation, but also can backfire into hostility from other people. This is especially true if you create a situation where people are feeling anxiety and see you as causing it. Therefore, while keeping other people informed is good, be careful not to over-do it.

Lastly, keep an eye on your mental health, behaviour and stress/anxiety levels. Keeping informed is good, but if reading about the latest exploits and that makes you feel afraid – especially if it’s in a way you can’t meaningfully act on, or if it’s an exploit you don’t need to overly stress about – then consider taking a step back. You’re not any good to anyone if you burn yourself out.