Doxxing issues are on the rise, along with deep fakes and AI. What can you do if someone posts your personal information online? If you’re a security clearance holder, should you be concerned about the security risks of doxxing? On the other side, what if you take things too far in an online dispute and find yourself having doxxed someone – could you face clearance issues?
Sean Bigley
Welcome back. You’re with Sean Bigley and Lindy Kaiser of clearance jobs.com. We’re talking this segment about an emerging issue, Lindy, which is doxing and deep fakes and all of the various iterations of AI and all this crazy new technology that’s coming out and how it’s going to impact clearance holders on potentially a very personal level. You were the one that suggested this topic. I’m sort of curious what you had in mind here.
Lindy Kyzer
Well, we did an article about the issue of doxing and how we could come up in the clearance process. I think it ties into the notion that continuous vetting now, and I was surprised that we didn’t hear more issues about that when we first kind of released the policy update, but we did get a lot of pushback around, Hey, continuous vetting. What is the government pulling in? Are they going to be finding information about me? That’s not true. I think that’s why the social media so far has not been used in a widespread basis because of this. I’m really curious to see how they move forward. I’m hearing more about both doxing and DeepFakes in the clear community, which doxing is when somebody posts your kind of private information out there publicly is posting information about you and then the deep fakes that they’re just doing, whether it’s images or, again, you mentioned AI generated stuff about you that’s fake, so fake content online, how that could come up in the security clearance process, and it was interesting, the article we had about it kind of had it from two sides.
What if you’re a victim of this or what if you’re the one doing it? If you’re doxing someone or if you create a deep fake image of somebody and post it out there, how could that relate to your clearance? I think it’s worth considering from both of those perspectives. If you’re a victim of anything, I always say it’s good to disclose it to your security officer again, if there’s deep fake information about you. Again, it ties into coming full circle. We recorded an earlier podcast that mentioned sextortion. If there’s something that’s posted about you online, your security officer is going to want to know about it even if it doesn’t come up through continuous setting right now. If social media isn’t pulled, I do think we are at some point down the road through some iteration, there are iterations of continuous vetting now that are pulling in social media, so you certainly could see that information come. I think the idea for the government is hopefully they built a technology system robust enough to sift through all of that. Good luck. May the odds be ever in their favor, but the idea is that we will see more information as this clearance process pulls in more and more information. It’s also going to pull in more information like this and it absolutely could have clearance and career implications.
Sean Bigley
Yeah, I guess from my legal perspective, I’ll sort of put my lawyer hat on here. I would start with the side of people who are actually doing this and creating DeepFakes or doxing. I mean that probably sounds bizarre to some of our listeners thinking, well, wait a minute, this is a show geared for people with security clearances. Who on earth is doing that? You’d be surprised. There are lots of people with clearances who have lots of weird hobbies and things that they like to do on the weekends, and there are a lot of clearance holders in particular with very, very advanced computer skills, lots of people in the computer space who are working in national security, and so I’ve seen over the years things that I never thought I would see where somebody said, well, I work at this national security agency during the daytime, but at night I’m engaged in this bizarre out there hobby or doing this or that.
Is this something that’s going to get me into trouble? In many cases, the answer is no, but this is not one of them, and if your hobby is creating DeepFakes of people and exploiting those or doxing people who you disagree with politically or whatever the case may be, that’s something that really could come back to bite you. It’s something that under the adjudicated guidelines would be covered under a guideline E, which is personal conduct, anything that would be viewed as questionable judgment or an integrity issue, reliability, those sorts of character traits. It could also implicate criminal conduct as well if what you’re doing is illegal as well as the sexual behavior guideline. We’ve talked about in other context how the sexual behavior guideline is very broad and it kind of sweeps in categories of behavior and content that sometimes people don’t think about, including if you’re into very unusual borderline illegal areas of pornography or behavior that may implicate black male risk, things like that.
So certainly if you’re generating deep fake nude images, for example, of somebody that could implicate a lot of different adjudicative guidelines, so I would just caution anybody who has the computer skills to do that and the inclination, be careful. That’s not an area that you necessarily want to play around with if you are keen to hold onto your day job. As far as the other piece of this and what I think is the more common way in which clearance holders are going to start encountering these issues, to your point about the blackmail piece, tell your security right away. I mean, if something like this happens to you and you become aware that somebody’s created deepfake nude images of me or somebody is threatening to release something that I’m really concerned about, I mean that’s blackmail. Certainly the latter. The former could implicate various criminal laws potentially, so what you don’t want to do is hide that information, hope it goes away, and then put yourself in the position where you’re tempting fate and you’re negotiating with a blackmailer or somebody who’s trying to cause you harm because that rarely ends well, and in fact, if that’s what you try to do and the government gets wind of it, that in and of itself could raise a judgment concern because if you’re doing it in this context, what happens if the next time the demand is for classified information?
What I always tell people in these contexts is as embarrassing as it is now, it’s going to be a lot worse down the road if you allow yourself to be victimized again and then security gets wind of it, but I think this is an area of fraught with potential issues for clearance holders. It’s very new and the regulation of AI in particular has just not caught up to the reality of how fast the technology is progressing. It’s really astounding to me. I mean, we saw this recently in the news, I think with Taylor Swift. I think there was a highly publicized incident of somebody who created deep fake nude images of Taylor Swift that we’re circulating on the internet, and now imagine if that’s you or I toiling away in the national security workspace. What does that mean? What’s the blackmail potential there? What’s the risk to national security? Some of these are unanswered questions.
Lindy Kyzer
No, and I think it comes up in, again, the fake profiles thing. I think we kind of talked about this in previous episodes before about how there are a lot of folks who are sharing content online that they shouldn’t, so what if you come across a profile that’s using your photo likeness image this all the time. When I worked for the Army, I had never seen so many general officers trying to find dates with their profiles, and I always had to explain to these four women who were then messaging me somehow at Army Public Affairs being like, oh, general, so-and-so our relationship broke off, and I was like, general Casey is not posting his official photo on Facebook. These are all fake, and we had such a hard time. It was like whack-a-mole. We could not get the sites to take them down, and that is the issue too.
That’s probably even another separate conversation, but the things that you can get by with saying sometimes on these online profiles, I don’t think the privacy laws have caught up with what people are capable of. Again, you can reach out many times and sometimes they’ll take them down, or if you have somebody posting content about you online, you cannot always assume that you can get it removed either from a lot of those sites. If you see something, oh, this guy posted something about me, it’s totally untrue. I think there’s a lot of clearance holders that are worried that that kind of information could come up in the clearance process. I’ll say for the most part right now it is. I mean, they’re not searching that deep, but it certainly could. Investigators have the authority to Google you or search your name and could certainly pull in information, and if you’ve been doxed or it’s fake information or people are posting things or DeepFakes or things that aren’t true, I think reporting something to your security officer is probably going to accomplish more at this point than reporting something to the social networks, which for the most part are probably not going to take it down in my experience.
Sean Bigley
Yeah, it’s very true, and I mean this is actually something that I’ve had recent personal experience with as well, with as somebody on the internet impersonating me as an attorney and my former law firm, something that I never in a million years thought I would have to deal with. I mean, who does that? Right? There’s a whole cottage industry of people who are doing that and impersonating attorneys ostensibly to steal money from prospective clients who think they’re hiring lawyer Smith or Jones, and in fact they’re just sending money to a scammer. You have to be cautious with this stuff, obviously as a consumer, but what I would say, and the message that I hope anybody who is listening to this and is a victim of any sort of deep fake doxing, anything along these lines, impersonation of any sort on the internet is don’t feel like you are the only person this is happening to.
I mean, I think that’s the fallacy that a lot of people fall into, and I will be the first to admit. It is hard to avoid that feeling when it’s happening to you. It feels like the world’s crashing down and you’re going, what did I do to deserve this? But the reality is there’s a lot of other people who are in this same boat, and so even though yes, it may be embarrassing to walk into your security office and tell them that there’s fake nude images of you on the internet, at the end of the day, my guess is this is probably not the first time they’ve encountered something similar. Using your example of all the fake dating profiles, I mean, this type of fraud and impersonation has been happening for a long time. The only difference now is the extent of realism is increasing and the ways in which to fool people are increasing, and so I think we’re obviously behind the curve, unfortunately in combating that if you are a victim of this, the worst thing you can do is to sort of bury your head in the sand or try to negotiate your way out of it because that just isn’t going to work.
