Being the target of mass online and offline harassment, whether because of sexism, racism, or other issues, can be overwhelming and devastating. This document intends to provide actionable guidance for people who are being attacked or who are concerned about being attacked in the future, and includes both information security, physical security, and self-care advice drawn from the experiences of the Geek Feminism community.

Should you become the target of an internet trollstorm, here are some immediate steps you can take to mitigate the damage:

If you're not already using a password manager and unique passwords, prioritize changing important passwords: Email, e.g. Gmail Facebook Twitter Tumblr Your domain registrar & hosting provider Amazon & eBay Apple Banking

Use a unique password for each site. Write them down or use a password manager (see below for more on this)

If you use Gmail, review the " Last account activity" details; this page can be found below your email inbox.

Go into security settings and verify which 3rd party apps you've granted access to. Remove unnecessary 3rd party access.

Check what email address you have as a "reset" account or backup account.

For services which allow posting-via-email such as Tumblr and Pinboard, have them generate a new email.

Remove expired or compromised payment methods from accounts.

Verify your account recovery information on important accounts, and (if possible) remove any where the answer has been leaked or otherwise findable.

Ensure that you have a PIN set for your mobile phone provider. There is often one required for voicemail, and a separate one for when you call or visit to make changes to your account. See this AT&T support page for an example of the latter.

Advise important parties (family, close friends, hosting providers, possibly your employer) what is happening and that they should verify any unusual inquiries with you.

Security practices

Passwords and authentication

Use a password manager such as 1Password, Dashlane, KeePass, LastPass or Password Safe.

Use different and complex passwords for each site. Never re-use the same password on different sites. Your password manager can generate a good password for you.

Avoid account recovery information which provides an easier route in, such as facts which can easily be researched (like zip code when your home address is publicly listed).

When updating your passwords, check the email address on each account. Since attackers can send password resets to the address on file, you should be sure every site has your most up-to-date and secure email address. If you have both a personal domain address and a Gmail or Yahoo or other corporate address, consider the corporate one more secure.

Set up two factor authentication on any service that supports it, especially Gmail if your password reset emails are sent to that address. twofactorauth.org is a comprehensive list of which services support two factor authentication.

Computer and information security

Non-tech identity theft stuff

Use a PO Box, commercial mailbox, or a work address instead of your home address when signing up for services that require a mailing address (in the United States, this often required for services that send mass email because of the CAN-SPAM Act).

Call the credit bureaus for your country and ask them to place a fraud hold on your credit report. There are commercial "credit protection" / "ID theft insurance" services that will do this for you, or you can contact the bureaus yourself. Canada United States - you can place either a 90 day hold or a 7 year hold Equifax Experian TransUnion



Physical security

Some options to tighten up your physical security include:

Security cameras at entrances at to your house, particularly if you live in a house rather than an apartment building.

Door chain, bar latch, or deadbolt that can't be picked or opened from outside.

Recordkeeping and troll-tracking

Set up a Google Doc or other shared file with your trusted readers/collaborators

Collect IP addresses and screen names of trolls/harassers

Include these records in your offline backups

Collectively block those people from your social media accounts Programs or websites might be available to automatically perform some of the blocking for you. On Twitter, consider @TheBlockBot or @blocktogether which can help you to block people who have already been blocked by others

Note dangerous or particularly egregious harassers and potentially identify and out them

Liz Henry has a great article on how to do this

Working with law enforcement

Reporting threats to law enforcement

You may wish to report threats of violence to law enforcement. While there have been some cases where harassers have faced judicial consequences, this is unfortunately rare. Despite the lack of effort most harassers put into their own operational security, getting law enforcement to do things like subpoenaing for IP addresses can be like pulling teeth. This is where record-keeping becomes extremely important - both of the harassment and of the interactions you have with the police; even if they don't take things seriously at first, having records of long-term harassment can be helpful if things escalate.

Here are some strategies to make this more effective:

Bring a friend with you for interactions with the authorities- this is important both for moral support and for having a second person there to witness the interactions. If you're calling the police, put them on a speakerphone or if possible record the call.

Provide detailed records - screenshots with timestamps and URLs, emails with full headers. Offer to provide printouts or a USB key if they would like a physical copy.

Swatting

There have been several instances recently of harassment escalating into Swatting, which is where a harasser calls law enforcement and reports a false claim of a hostage or other violent situation. If you're experiencing large-scale online harassment, you may wish to call local law enforcement and ask them to call first in case of reports made about your address. Here is a script you can over the phone or in person to your local law enforcement officials:

[First ask if they are familiar with SWATting, if not explain:] My personal information, including address/phone number/social security number [as appropriate] were recently posted on the internet by someone who is harassing [or stalking, as appropriate] me. There is a chance that someone may call in a fake bomb or hostage threat at my address as part of the harassment, so I wanted to reach out and let you know that this could happen. If you receive a threat like this for my address, I need you to call my cell number before sending emergency responders.

Mental health and self-care

If someone makes a request of you that makes you feel uncomfortable, especially if that person has treated you poorly in the past, you don't have to do them that favor. You don't owe them an explanation for why not. You are allowed to just say no.

Ask someone you trust (but possibly not someone SUPER close to you, think friend-of-a-friend who isn’t in your industry) to take over moderation duties on your Twitter/FB/blog for a certain number of days/weeks. They’ll send you whatever comments or replies require a response, everything else gets trashed (or saved in a separate file) without you having to see it. (This is a great opportunity for them to block people who only aim to cause you grief, so you won't run into them later.) Consider setting your Twitter notifications to "People you follow." Friends can monitor the replies you receive from strangers by searching for [to:your_screen_name].

Set up a "safe list" of important personal contacts whose communications you'll want to see.

If the volume of interactions becomes too much, ask your friends or followers to avoid mentioning you when they engage with abusive people, so that you are not included on those conversations

Remind yourself that progress is a choir, not a solo ; you don’t have to pay attention to all jerkfaces and answer all questions all the time forever and ever. Let other people sing, get some sleep.

No really, get some sleep. Also don’t stop showering (even if you work from home, even if it seems really difficult). Same with food -- your brain needs food so it can feel better.

Seek out media that can comfort you in a tough time -- favorite shows, books, movies, music.

Ask your friends on the net and locally for emotional and practical support. Have someone come over, go to a friend’s house, do something outdoors non-internet related.

Talk to someone else who has experienced the same kind of harassment.

In extreme cases it might be a good idea to just go on vacation and not look, if possible.

If you're seeing a therapist or considering finding a new one, see our page on Resources for therapists for information you can print out or email to your therapist for background information on sexism in geek culture.

Resources for friends and family of people facing online harassment