The following is an excerpt from SWIPED: How to Protect Yourself
in a World Full of Scammers, Phishers, and Identity Thieves.
Reprinted with permission from PublicAffairs Books.

What’s in a Name (and a Number)?

“I was just doing it to tease her, basically.”

It was a harmless tweet. A girl named Brooklyn from Prosper, Texas, sent a picture to her friend Alanna in reply to one of many tweets about a cute boy Alanna had seen while shopping at a big-box store in nearby Frisco. Then something fundamentally unknowable happened: the mysterious Internet phenomenon of going viral.

Viruses reproduce by sending their DNA into a host cell, leav- ing the infected host, now itself a virus, to find another host cell for further reproduction. On the Internet, that process of cellular invasions and osmosis happens to users rather than cells, and it happens very fast. The DNA can be anything—a hilarious video or an unexpected quip harnessed to a snapshot. On November 2, 2014, the DNA was Brooklyn Reiff’s week-old picture of a teen- age boy named Alex Lee, tweeted as a playful fillip to her friend’s obsession.

How did Brooklyn’s sneaky shot of Alex Lee invade an entire population, replicating her friend Alanna Page’s crush in one user after another?

You might call it theft. In fact, there were a lot of little robberies— and they added up. The first one happened when Brooklyn went beyond the act of stealing a glimpse of the checkout boy, and snapped his picture. The young man in question didn’t pose for the picture. He had no idea that a picture had been taken. Certainly, no modeling release was signed. He was just there, doing his job.

Lesson Number One: In the world of Big Data, with mobile, Internet-connected cameras in every pocket, we are always just a few clicks away from being everywhere. The young man whose picture went viral got a real-life taste of that fact when his total lack of privacy became apparent; he became an Internet sensation
by doing nothing but bagging products at the checkout counter.

More than 500 million photographs are uploaded to major websites every day. More than 2 billion pictures are taken on mo- bile devices every day. Factor in webcams and other surveillance devices, and the chances that your image isn’t somewhere on the Internet are right up there with becoming the next Dalai Lama.

Alex Lee experienced one of these countless daily intrusions that happen in our social media–obsessed society. He won the jackpot in the “privacy is on life support” sweepstakes. It didn’t matter that he was tending to his own business. His existence cre- ated the potential for a transaction—one that required neither his consent nor his participation. The snapping of his picture underscored a simple reality: If you’re out in the world, the world can look at you. And if the world has a smartphone, it can snap, store, share, and reshare you, all in just a few taps, each one a little theft of your face, your identity, your self.

In this particular instance, someone grabbed Brooklyn’s snapshot from her Twitter account and put it on another social networking site, Tumblr. Brooklyn had no idea. Meanwhile, the picture started replicating on Twitter accounts. While the com- plexity of the picture’s distribution was at least potentially know- able, it was in no way controllable. The million “little thefts” that made Alex Lee famous are metaphorical. No court of law would rule that Brooklyn’s actions, or any of the actions of other people who retweeted her photo, rise to the level of theft. But, well, you get the picture—as did millions of people around the world.

Needless to say, Alex Lee had no idea any of this was happen- ing. He hadn’t done anything wrong or unusual. There were no regrettable posts, no questionable sites visited, no malware behind it all. His phone wasn’t even powered on when the month-long distribution of his image reached critical mass the following Sunday sometime during the Cowboys-Packers game. It was right after that game that Brooklyn first noticed something was afoot on Twitter. She started getting mentioned in posts even though she didn’t have very many followers. Her surreptitious shot of Alanna’s crush with the waterfall of Justin Bieber hair was getting love from people she didn’t know. Among those taking a shine to the checkout boy was a teenager in the UK who had liberated the picture of Alex from a Tumblr user, who had pinched it from Brooklyn’s original reply tweet to her friend Alanna. The British girl’s tweet was simple: “YOOOOOOOOOO.”

A long line formed at Alex Lee’s checkout station. It was filled with giggling girls. The reason Alex had turned off his phone was the banal stuff of disorganized people everywhere—no charger, low battery, and needing to get in touch with his parents when his shift was over so they could come pick him up. It was his manager— a senior in high school—who told him what was going on, showing him the picture that had started to go viral. By the time he turned on his phone in the front seat of his mother’s Mercedes at the end of his shift, he had more than 100,000 followers, virtually all of whom were new that day. That number would triple before the end of the twenty-four-hour clickstorm set off by the Twitter user named @_twerkcam, who retweeted the “YOOOOOOOOOO” tweet with the hashtag that launched a million mentions— #AlexFromTarget. Brooklyn Reiff’s picture had gone viral.

Alex’s first tweet was a bit disingenuous. “Am I famous now?” he wrote. That of course got retweeted 42,000 times and was favor- ited by more than 86,000 users. The hashtag became a trending topic, and talk show host Ellen DeGeneres used it, tweeting, “Hey #AlexFromTarget, it’s #EllenFromEllen.”

Something else happened, too. According to the New York
Times, Alex Lee received death threats against him and his family. He had to change his phone number because some- one had leaked it—or his phone was hacked. The device failed, unable to keep up with all the texts that came streaming in.

These last details of the #AlexFromTarget story got precisely one buried paragraph in the Times. Regardless, though, they high- light the nature of the identity theft problem.

It’s important to point out at the outset that it’s highly unlikely the Lee family was singularly lax about their personally identifi- able information (PII). They didn’t do an Edith Byrd, the woman who famously held up her Medicare card during Bill Clinton’s speech at the Democratic National Convention in 2012, showing millions of potential identity thieves her name, enrollment date (the next best thing to a date of birth), and Social Security number. The Lee family’s information was likely already “out there”— either on the so-called dark web, where dangerous hackers trade other people’s secrets for money (or Bitcoins), or on a public-facing database. The reality illustrated in the breach of the Lee family is very simple, and should be a guiding principle in the way you think of your personally identifiable information: The only thing a hacker really needs to get your PII is a little motivation.

The Lee family’s personal information was leaked online within hours of the viral explosion of #AlexFromTarget, and the cache of exposed data included some serious digits: bank account num- bers, Social Security numbers, and phone records. Worried about the safety of Alex and his five siblings, his parents spent many frenzied hours reaching out to school officials, the police, and security companies.

For press and media requests and to receive a review copy, please contact Lelani Clark at 646-649-5766 or lelani@adamlevin.com