The Platform and the Tunnel

Matthew Herrick reported his own harassment to a company more than a hundred times, and the company did nothing. It is the starkest single fact in this book’s account of platform failure.

Beginning in October 2016, Herrick’s ex-partner created impersonating profiles of him on the dating app Grindr and a smaller competitor called Scruff, describing him as interested in specific rape-fantasy scenarios and directing strange men to Herrick’s home and workplace for sex. At the peak of the campaign, as many as sixteen men a day showed up at his door; the pattern repeated more than a thousand times over five months. The ex-partner later pleaded guilty to stalking, identity theft, falsely reporting an incident, and criminal contempt, and was sentenced to prison in 2019 — the conduct described here is not an allegation but a matter of his own admission and the court’s record.¹ Herrick reported the impersonation to Grindr more than a hundred times with no effective response. Scruff, the smaller of the two platforms, responded immediately — a personal email expressing concern, takedown of the fake accounts, an IP ban on the person responsible.² The same abuse, reported to two different companies, produced two entirely different outcomes: effective intervention was operationally possible. It was not a technical impossibility Grindr couldn’t meet. It simply didn’t happen.

Herrick sued Grindr, framing the claim as a products-liability case to route around Section 230 of the Communications Decency Act, the federal statute shielding platforms from liability for content their users post. The Southern District of New York dismissed all fourteen claims; the Second Circuit affirmed the dismissal; the U.S. Supreme Court denied certiorari in October 2019. Grindr faced no legal liability whatsoever, despite more than a thousand documented incidents directing strangers to a specific person’s home over five months.³ This is the deniability this book has traced through every scale. Section 230 doesn’t merely make a platform practically difficult to hold responsible for what happens on it. It is a statutory grant of exactly that deniability, written into federal law and upheld all the way to the country’s highest court.

Two further mechanisms round out the pattern, each a distinct product-design failure rather than a repeat of Herrick’s moderation failure. WhatsApp’s public “Online” status indicator, intended as a convenience feature, was documented by the cybersecurity firm Traced in 2021 to be passively monitorable by anyone, without the monitored person’s knowledge or consent, enough to build a detailed log of when a specific person is active on their phone. Because the status is public by design, a stalker needs no special access, only the target’s phone number.⁴ The feature works precisely as built; the surveillance is simply a side effect nobody accounted for. Published research from the British Psychological Society finds online status indicators generally make users feel under surveillance by partners or family watching for sign-ins, producing measurable anxiety around how quickly they’re expected to respond.⁵ Snapchat’s Snap Map feature drew a related but distinct concern from police and child- safety advocates from its launch onward — real-time, precise location- sharing with “friends,” a category that can include near-strangers on a youth-dominated platform, capable of leading someone directly to another person’s front door. Snapchat’s own response, a feature called Ghost Mode that lets a user retain full Snap Map functionality while hiding their own location from others, reads like the vendor responses this book has noted elsewhere: an acknowledgment, embedded in the product itself, that the default visible state carried a real risk the company felt compelled to build an opt-out for.⁶ Between them (a moderation failure, an architectural default, and a feature that must be opted out of rather than defaulting to safety) they produce the identical result: a platform built for ordinary use becomes a surveillance or contact vector for anyone willing to misuse it, absent a deliberate choice to make safety the default.

Every mechanism examined in this book so far has involved a tool being turned against someone. What follows is more specific: a tool a person might reasonably rely on for protection, repeatedly proven, under real legal pressure, not to deliver on that promise.

Ryan Lin was charged in 2017 with an extensive cyberstalking and hacking campaign against a former roommate, her family, friends, and various institutions, using the VPN service PureVPN throughout. PureVPN’s own privacy policy stated plainly that it did not monitor user activity or keep logs of any kind. In practice, the company retained connection timestamps and originating IP addresses — not full browsing records, but enough for investigators to run a time-correlation analysis: the same VPN connection touched, within minutes of each other, Lin’s real Gmail account, a threatening secondary email, and an account he’d created on an unrelated service, tying his real identity to his anonymous activity with certainty.⁷ This was not an isolated failure. Six years earlier, independently, Cody Kretsinger used the proxy service HideMyAss while participating in the LulzSec hack of Sony Pictures; a single UK court order compelled the company to hand over stored IP-address logs and connection timestamps, directly identifying him and leading to his conviction. A Tor Project developer publicly called the company hypocritical for marketing privacy while retaining exactly the data that ended its user’s anonymity.⁸ The pattern extends well past these two cases: IPVanish, despite marketing what it called a strict zero-logs policy, provided detailed connection logs to Department of Homeland Security investigators in 2016; seven separate VPN providers, each claiming a no-logs policy, were found to have exposed 1.2 terabytes of user activity logs; and the Center for Democracy and Technology filed a formal FTC complaint against Hotspot Shield in 2017 alleging its no-logs and no-tracking claims were false.⁹ Across these cases, the same structural gap recurs: “no logs” reliably means no content logs, not no metadata — and connection timestamps paired with IP addresses are, on their own, sufficient to deanonymize a specific person the moment a legal process compels their disclosure. Beneath that sits a distinction the marketing elides entirely: a “no-log” policy is a promise not to keep records, not a technical inability to produce them. A provider that has merely chosen not to log can be ordered to start, or found to have logged anyway — the latter being exactly what the PureVPN and IPVanish cases above document. Only an architecture that cannot retain what it never stored, verified by outside audit rather than asserted in a policy, offers protection a court order cannot reach. Someone evading a stalker or an abusive partner who believes a no-log VPN makes them genuinely untraceable is relying on a claim that has failed, under real legal pressure, in multiple independent and fully documented cases. It is exactly the kind of assumption this book’s closing chapters insist on verifying rather than trusting, when the stakes of being wrong are someone’s physical safety.

A related but distinct mechanism shows the same disguise running in the opposite direction: not a privacy tool failing to protect, but a privacy tool built, from the outset, to surveil. Facebook acquired the Israeli mobile-analytics company Onavo in October 2013; its flagship product, Onavo Protect, was marketed to consumers as a VPN, a privacy and security tool. Installing it in fact gave Facebook visibility into every app opened on the device, how long each was used, and every website visited — data the company used to track competitive threats, monitoring usage of Snapchat, YouTube, Amazon, and Houseparty.¹⁰ In 2016, Facebook developed an internal technical method, candidly named “Project Ghostbusters,” to decrypt and intercept Snapchat’s own encrypted traffic for competitive analysis, using the Onavo pipeline as the delivery mechanism.¹¹ The consequences that followed are unusually complete for a corporate-surveillance case: Apple forced Facebook to remove Onavo Protect from the iOS App Store in August 2018 for violating its data-collection policies; renewed reporting the following year revealed Facebook had been paying teenagers to install a rebranded version called Project Atlas through a research app distributed outside normal app-store review, and Facebook sunset Onavo entirely rather than continue defending it;¹² and in July 2023, Australia’s Federal Court ordered Meta to pay twenty million Australian dollars specifically for failing to disclose how Onavo’s data collection would actually be used. That is a completed legal penalty, not a pending allegation.¹³ It is the identical inversion this book has already documented at the individual scale, in apps marketed as “parental monitoring” and browser extensions requesting permissions no translator actually needs. Here it was run not by an individual abuser but by one of the largest technology companies in the world, with a fully adjudicated legal outcome to show for it.

What unites both halves of this chapter is a single usable fact. The platform that refused to help Herrick still held the records of every impersonating account; the VPNs that promised to hide Lin and Kretsinger kept the connection logs that convicted them; even Onavo’s covert collection became a paper trail a court could penalize. A tool can fail every person who trusted it and still be scrupulously honest about one thing: who used it, and when. That record — not the broken promise — is the answer Part II has been building toward across every surveillance mechanism in it.

One layer sits beneath even the platform and the tunnel, and it is worth naming because it defeats the intuition this chapter has been dismantling in its most stubborn form — the belief that a secure app is enough. Interception at the cellular network itself requires no compromise of the target’s phone and no access to any account. The signaling protocols that route calls and messages between carriers — the SS7 system and its kin — carry long-documented weaknesses that allow calls, texts, and location to be pulled from the network side; and the device known as an IMSI-catcher, a false cell tower that nearby phones connect to automatically, harvests the same data out of the air, available well below the level of a state.¹⁴ The encrypted messenger protects the message’s contents; it does nothing about a network that can log who is talking to whom, and where, without ever touching the endpoint at all. The tunnel can be perfect and still open, at its far end, onto a road that was never yours.

In plain terms: the phone network itself can be listened to — without touching your phone and without breaking into any account — so even a flawless encrypted app hides what you say but not who you spoke to, when, or where. No app setting fixes this; it is a limit of the network, and the only safe assumption is that the record of who you contacted, and when, is not private.