“All of us matter, or none of us do,” a strong statement from Shannon Miller, OSINT Investigator and Privacy Consultant. For those of us who know Miller, it’s not the first time we’ve heard that plea and it won’t be the last. Her significant career and non-profit work to help victims of domestic danger and other similar malice find safety, she’s seen first-hand how the dangers are amplified for marginalized and vulnerable groups who do not have as much access to tools, education, and other critical resources to protect themselves and their families.
Miller’s work goes beyond individuals and families, however. Consider the Fortune 500 or startup executive who might have a disgruntled former employee, or has caught the attention of a cybercriminal, or another type of stalker, who needs to protect themselves, their companies, and their families.
The upside of all the technology and access we have is also what creates so much risk in the multitude of dangerous situations that Miller has seen and helped people out of in the most efficient and least disruptive ways possible. But, we as a cyber community have to help, but building ethics and integrity into our products so they can be used less maliciously in human cases; not simply data cases.
Anything created can be used for good or it can be abused. Our community has an obligation to ensure tech is created with ethics, integrity and guardrails in place to minimize the harm.
Read on to learn more about Miller’s critical and impressive work, how she takes it beyond her career and does fundraising for those who need help and can’t afford it, and where the line between her cases with stalkerware and cybersecurity abuse bridge her natural talent as an OSINT investigator. She also talks about maintaining balance in a rapid-paced and also emotionally straining career.
Oh, and if she wasn’t working in cyber she’d specialize in equine therapy for people with post-traumatic stress disorder (PTSD) and complex-PTSD (C-PTSD). That tracks.
Q. You have an extremely dynamic profile online. If you were to sum up all of you into a quick description, what would you say?
A. Tiny terrifying blonde with all the data. That’s the description a friend gave me, I ran with it.
Q. You’re very vocal about your work in privacy consulting and digital safety training, and you cover a significant amount of use cases. Which areas of privacy and safety satisfy you most?
A. I find cases of stalkerware and cyberstalking some of the most interesting, because there’s so many different ways I’ve seen it occur. The patterns are similar, but purpose or reasons for doing so vary, depending on the individual, nation state, or case.
Q. Can you provide an example of a situation where your work was pivotal in someone’s safety – only if you can do so without risking anyone’s anonymity?
A. Any of my cyberstalking or in-person stalking cases are some of the most unhinged things you can imagine. I’m very rarely surprised by something, but finding out the client I worked with was being targeted by multiple individuals with varying degrees of obsession was definitely new for me.
The most important thing with this particular client was to ensure they were safe. We had to look at their entire life, and uprooted a lot of it to get them to safety. I do my best to minimize harm to their life/livelihood, but sometimes circumstances require major changes. The situation resolved as best it could. All that to say, each situation is unique and many don’t require an entire move or life change, but you assess each one individually.
Q. What is the most important message you are hoping to convey through your online presence or work?
A. Keep it simple. When everything complicated is failing, go back to basics, and teach them over and over again, until the audience moves forward. I’ve spent a decade doing this and still share the same basic principles and safety measures. Technology changes, so do people, but sometimes the things they need the most are to to be seen, heard and understood. This job is a lot of emotional support and working through the things where the client gets hung up making a decision, or moving forward.
Q. How did you get started in this, anyway? Tell us a bit about your career.
A. It all started when I was 16 and the manager of the bagel shop I worked at told me I didn’t have the skills to sell bagels.
When someone in a position of authority tells you that you aren’t good enough, or can’t do something, it will go one of two ways, it will crush you or inspire you. I can’t say I was inspired then, but it did set me on a path to get me where I am now. I was told many times by a boss I was too much, too loud, too ambitious.
I landed in OSINT as a result of a layoff and a romance scam. A family member was scammed out of a lot of money and reached out to me for help. I knew immediately what it was, but sometimes the person in the middle of the scam doesn’t see it.
I took all the skills I learned in my career and began digging into OSINT. Turns out my background and curiosity paired well to do investigations.
Q. How do you stay motivated and productive during challenging times? I imagine the cases you work on must be emotionally grueling at times.
A. Some days I don’t stay motivated or productive and stare at a blank screen. I’ve learned a lot about running a business and burnout the hard way. I’d say the most important lessons learned are to have a good emotional support system and set firm boundaries around your time, cases, and emotional bandwidth to help others.
The amount of energy and time devoted to cases has to have a balance. I say no to more cases than I say yes, simply because I don’t have the resources or time to do them. It’s why I’ve pivoted to teaching classes, group coaching, and providing community workshops and not only 1:1 services.
Spreading out my workload and taking less cases has helped immensely to protect my own peace and mental health. I couldn’t do this work at all if I wasn’t mentally, physically and emotionally capable in my own life. What’s that saying of not being able to pour from an empty cup, you have to fill yours first, before you can help others.
Q. In addition to your paid consulting I know you do a lot of help to support NGOs or simply people and families in need. Will you please describe some of that?
A. As the world changes, you have to adapt and shift your tactics, delivery, and capabilities to help more people. While people like to tussle over politics, I remind them, everything is political. It’s no different in community care, mutual aid, or non-profit work. If systems cannot or won’t support communities, you have a responsibility to help build parallel systems of care that can. This means not leaving anyone behind, not sacrificing one group over another. Everyone deserves dignity, food, shelter, healthcare, and it’s why I help fundraise and partner with organizations that are already doing the work on issues that matter to me.
Q. How do you see your role or purpose evolving in the future?
A. I’ve been organizing since high school. I use those organizing skills to pair people who can provide mutual aid, information share online and offline communities & provide digital safety training to orgs so they can help more people.
I see the organizing evolving into more grants to do more work in the local communities. As you know, it’s especially difficult to get government grants now, funding has slowed or been pulled from many community organizations. This funding gap means that you have to get creative with fundraising and finding private grants. My focus is really that communities can build more sustainable funding efforts so organizations can do their work.
It’s really going to take a lot more of us to build better systems for everyone, and that includes the government. I’m inspired by all the people running for local school boards, library boards, city and town councils and local offices. It’s so important you have support and partnership with government entities and community organizations for these efforts to build sustainable community systems of care.
Q. When is the time in someone’s life when they should pick up the “Bat Phone” and engage someone like you?
A. It would be great if people reached out to me before they were in a crisis or an urgent situation, but oftentimes that doesn’t happen, or isn’t possible. I also recognize no matter how much I talk about privacy, safety, and the steps people can take, it’s inconvenient and not easy. The steps are simple, often the implementation isn’t.
My industry and what I do is pretty unique as well, and visibility to the people who might need my help is challenging sometimes. People don’t want to put trust in someone they’ve never met, worked with, don’t recognize or haven’t engaged with before. It’s why a lot of the time, my cases or consultations are on a referral basis.
I’m working on ways to expand my offerings to help more people, on a larger scale, because while I love the 1:1 work, more people need help now. Follow me on my socials and bookmark my website to get notified when all the things are live.
Q. How can families create an emergency preparedness plan with cyber safety in mind?
A. For cyber safety planning, there are three things I recommend every family have, a communications plan, an emergency escape plan (exits, routes, maps, roads & destination in my mind) in case of natural disaster, and family code/safety word if someone is under duress, kidnapped, or in trouble.
These plans can vary in the level of complexity. If you’re already doing emergency preparedness, the items you’ll want in your go-bag, include radios or walkie talkies, chargers & cables, battery packs or solar charger, emergency contact list, important documents (hard & soft copies), medical files & information for family/kids/pets, a way to access your passwords/systems, backup USB/microSD with your important documents, comms, protocols, etc.
There’s a lot more detail I’d put into an emergency cyber safety plan, but off the top of my head those are the things that I’d want. I say all this knowing people will add a dozen things to that list or take issue with what I prioritize. This list is generic in nature, and may not reflect the needs, access to resources, and situation of every person or organization.
Q. How can technology be used to improve domestic abuse security and protection?
A. Give resources to underserved communities and vulnerable groups. Not everyone has the same access to technology, internet, or the latest phones, computers and systems. Part of helping protect people is ensuring they have the tools, knowledge, and training to help themselves and each other, and access to those resources.
Unfortunately, technology isn’t going to solve the underlying problems associated with domestic abuse, that is a human problem. Tech-enabled abuse is simply an extension of the cycle of abuse experienced in intimate partner relationships or cases of domestic violence in other relationships.
What you can do with technology is skill-share, train victim advocates, connect people to one another who have resources, build communities, establish secure communication networks offline, and organize locally. Technology plays a vital role in all these ways.
One of the most effective ways to help people in your own community is to do in-person safety training. Gather folks locally, and walk through the basics, together. People put off doing the security/safety steps with their devices, but will do it with others. It’s community work, relationship building, and skill sharing all rolled into one event.
Q. What preventive measures can be taken to protect vulnerable members of the household?
A. Communication is key when talking to chosen family/friends/kids about potential threats and risk. Establish the main concerns for your family unit with some of these questions:
- What are you trying to protect?
- Who or what are the threats?
- Who has access?
- How might these threats impact your family’s privacy or security?
- How likely is it that it will happen?
- How would they do it?
Answering these questions can help determine your own threat model and what a safety plan looks like for your family. There are no right or wrong answers, simply determination of what you are trying to protect, and who you are protecting it from. Understanding the consequences if you’re targeted, who might target you, helps prepare you for how to respond in a crisis.
Q. How important is security community awareness and involvement in domestic safety?
A. One of the principles I teach is threat modeling, whether you’re the person in the situation, adjacent to it, or simply have an interest in helping. Part of threat modeling is knowing how someone is at-risk, the level of monitoring/surveillance, the threat level, what might happen, what is likely to happen, what has happened. Each situation is unique, and requires a slightly different response or plan.
You have to take into consideration the family/friends, their support system, their capacity, their finances, all things required to move someone out of a dangerous situation. Additionally, does their spouse/partner/stalker monitor their devices and how that impacts your ability to help them.
The broader security community understands threat modeling when it comes to cybersecurity, you can apply those same ideas to domestic abuse & stalking situations. You’re doing an assessment or audit of the tools, threat actors, activity, expected or anticipated outcomes.
Clearly I’m simplifying the problem solving, but there are tangible and tactical ways to help people, and that starts with threat modeling, harm reduction, and meeting them where they are emotionally, physically and mentally.
Q. If you had one wish for support from the security community to help aiding in protection of the most vulnerable people, what would it be?
A. Listen to marginalized and vulnerable people when they tell you what they’ve experienced, how to fix it, especially when it comes to harm reduction. The idea that we should move fast and break things means it comes at the cost of other human beings, their dignity, their choices, their rights, their autonomy, their humanity. Everything has a human cost, especially where technology is involved.
Anything created can be used for good or it can be abused. Our community has an obligation to ensure tech is created with ethics, integrity and guardrails in place to minimize the harm.
There’s so many opportunities to help others with the skills people in the security community have. Teach someone what you know, skill-share, provide scholarships and mutual aid, build community.
All of us matter, or none of us do.
