Better the digital devil you know - Digital Threat Digest

For a long time we’ve worked on the assumption that once something is on the internet, it’s there forever. Facebook photos from Thursday nights out at undergrad, tweets from 2009 giving your thoughts on Scottish football performances, and a long-abandoned Tumblr hosting some sort of angsty teenage blog, all just sitting in the digital ether, ready to be rediscovered at any point.

In the last year or so I’ve begun to think the opposite is true – that true preservation only occurs in offline media or in some form of local storage. When that friend from 2011 deletes their Facebook profile, all the photos they hosted of you vanish. Twitter (either deliberately or accidentally – it’s hard to tell these days) can’t show tweets from before 2014 when you scroll back through a profile.

Unless you had downloaded every image at your peak-Facebook-friend-network-size, it’s likely that a good 30% of your life that had been visually documented there a decade ago is now gone forever.

The same is true for the non-social side of the internet. A decade ago, if you googled the name of a TV show you’d be inundated with links to Megavideo, Project Free TV, Putlocker, SolarMovie, and Viooz. You would take your pick and pray that your default search engine didn’t inexplicably change as you began streaming. Try it now and you can’t find that same variety – you get 30 different legal paid streaming options, and then Google claims that there’s nothing after page three of the search results. This is obviously “better” from a corporate product perspective, but is it better from a user perspective?

The same argument can be made for properly malicious stuff online. Malware is indexed and preserved by entities like vxunderground, so that you can revisit, download, and mess about with old campaigns. It’s a resource, a library, an archive, and a learning tool. But take something like an influence operation on a social media platform and the response options mean that library isn’t there. Campaigns are deplatformed, and they’re gone forever. If you saw it and indexed it when it was live, lucky you, you can build proactive detection based on those indicators and behaviours. If you didn’t, well tough shit, you’ll never see it. Reddit is the only platform to do this differently – preserving the accounts and posts made by prominent, well-attributed campaigns for posterity. It means you can learn from them, observe how they behaved over time, and then hunt for similar patterns.

It's a hard choice – the preservation of harmful material on your service vs protecting users who come across the material – but there has to be a better way than scrubbing the records from existence. 

Maybe it’s better the digital devil you know.

More about Protection Group International's Digital Investigations

Our Digital Investigations Analysts combine modern exploitative technology with deep human analytical expertise that covers the social media platforms themselves and the behaviours and the intents of those who use them. Our experienced analyst team have a deep understanding of how various threat groups use social media and follow a three-pronged approach focused on content, behaviour and infrastructure to assess and substantiate threat landscapes.

Disclaimer: Protection Group International does not endorse any of the linked content.