How I caught my cyberstalker

How I caught my cyberstalker

Speakers: Bernie Garnell, Safe Advisory

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=z2s1F7xGzog

Overview

Bernie Garnell's CHCon talk, "How I caught my cyberstalker," delivers a deeply personal yet highly technical account of navigating a prolonged cyberstalking ordeal. Far from a mere anecdote, Garnell, a recent cybersecurity graduate from AUT and consultant at Safe Advisory, meticulously breaks down the tactics employed by her stalker and, more importantly, the investigative and defensive strategies she leveraged to identify, document, and ultimately deter the perpetrator. This presentation transcends a simple victim narrative, evolving into a practical guide for understanding, identifying, and mitigating the pervasive threat of cyberstalking in an increasingly interconnected world.

The talk is a critical contribution to the cybersecurity discourse, highlighting not only the technical vulnerabilities that enable such attacks but also the significant psychological toll on victims and the systemic gaps in legal and institutional responses. Garnell's experience underscores the importance of proactive digital footprint management, meticulous evidence collection, and a nuanced understanding of stalking behaviors beyond conventional definitions. Her insights are invaluable for individuals seeking to protect their online presence, for cybersecurity professionals aiming to better understand real-world threat vectors, and for policymakers advocating for more robust anti-stalking legislation.

Garnell's primary goals for the presentation are threefold: to raise awareness about cyberstalking, to share actionable tips for online safety, and to demystify a frightening experience through a structured, analytical timeline. By framing her traumatic experience within a cybersecurity lens, she empowers the audience, from young individuals to seasoned professionals, with the knowledge to recognize subtle signs of stalking, secure their digital lives, and advocate for stronger protections within their communities.

Background

▶ Watch: Introduction and talk goals (0:00)

The problem of cyberstalking, as Garnell illustrates, is deeply rooted in the pervasive nature of online social platforms and the often-unacknowledged public accessibility of personal information. In an era where digital identities are intricately woven into daily life, even seemingly innocuous online activities can provide valuable reconnaissance for malicious actors. Garnell's journey began with an inherent paranoia about her online presence, a sentiment that proved prescient given the events that unfolded. Initially, the threat manifested subtly through persistent and increasingly realistic fake social media accounts attempting to connect with her. This phenomenon, where cyber criminals develop sophisticated profiles, is a common precursor to more targeted attacks, often dismissed as mere spam or phishing attempts.

A significant challenge highlighted by Garnell is the general lack of awareness regarding what constitutes stalking. Many victims, including Garnell herself, initially struggle to categorize intrusive behaviors as stalking, often attributing them to coincidence or overthinking. This ambiguity is compounded by legal frameworks that may not fully encompass the diverse manifestations of modern stalking. Garnell references a definition by the Auckland Coalition for the Safety Women and Children and the National Collection of Independent Women's Refugees, defining stalking as "the unwanted and repetitive persistent intrusion into a person's life." This definition is crucial because it emphasizes persistence and unwantedness, which are often overlooked in early stages.

Further context is provided by Dr. TK Logan, a professor from the University of Kentucky, whose research categorizes stalking behaviors into SLI strategies: Surveillance, Life Invasion, Intimidation, and Interference. These strategies provide a framework for understanding the multifaceted nature of stalking, moving beyond simple online monitoring to include real-world actions and psychological manipulation. Garnell's talk effectively demonstrates how her stalker employed each of these strategies, transitioning from digital reconnaissance to physical presence and psychological harassment. This background sets the stage for a deeper technical analysis of the attack vectors and the counter-measures available.

Key Findings

▶ Watch: Unmasking the stalker: connecting mutual friends (6:00)

Bernie Garnell's experience yielded several critical findings that offer profound insights into the nature of cyberstalking and effective defensive strategies:

• Subtle Commencement of Stalking: Stalking often begins with seemingly minor, easily dismissible actions, such as persistent, unwanted follow requests from unfamiliar accounts. These initial probes can be highly sophisticated, leveraging mutual connections to appear legitimate. Garnell noted she received requests from accounts with "23 mutual friends," which is common in Auckland, blurring the lines between legitimate and malicious intent.
• Victim's Initial Misinterpretation: Victims frequently fail to immediately recognize these intrusive behaviors as stalking. Garnell initially believed she was encountering sophisticated "cyber criminals" creating fake accounts for general purposes, rather than a targeted individual. This delay in recognition can prolong the stalking period and hinder early intervention.
• Criticality of Digital Footprint Analysis (Self-OSINT): Proactively investigating one's own digital footprint (often termed self-OSINT or self-dorking) is an indispensable defense mechanism. Garnell's post-incident deep dive revealed a surprising amount of publicly accessible information about herself, despite her belief in her stringent privacy practices. This process involves searching for usernames, emails, phone numbers, old gamer tags, and full names combined with specific locations or hobbies using Google dorking techniques.
• Indispensable Role of Evidence Collection: Meticulous documentation of every suspicious interaction, message, and observation is paramount. Garnell's habit of taking screenshots of every communication and maintaining timestamped records, often in chats with friends, proved crucial when finally reporting the incidents. This evidence transforms anecdotal experiences into concrete proof of an ongoing, persistent issue, essential for law enforcement and institutional action.
• Importance of Early Reporting: Despite initial hesitation, reporting incidents to authorities (e.g., NetSafe, police, university) as early as possible is vital. Even if no immediate action is taken, establishing a formal record creates a history of the problem, which can accelerate responses if the situation escalates. Garnell regretted not reporting earlier, noting that her 6-month accumulation of evidence eventually enabled action.
• Gaps in Legal Frameworks: Existing legal structures, such as New Zealand's Harassment Act and Harmful Digital Communications Act, may not adequately cover the complexities of cyberstalking. This often makes it challenging for law enforcement to act proactively, leading to a reactive approach where serious physical threats are often required before intervention. Garnell highlights a proposed law in parliament that would address this by penalizing specific acts like following or recording, with penalties up to five years in prison.
• Severe Psychological Impact: Stalking, even without physical violence, inflicts profound psychological trauma. Garnell experienced anxiety, hyper-sensitivity to cameras, a fear of specific physical traits (pastel pink hair), and developed reverse stalking behaviors, where she monitored her stalker to gauge threat levels. She cited a 2023 study indicating that 91% of stalking victims suffer from anxiety, depression, panic attacks, anger, PTSD, and suicidal thoughts.
• Stalker Behavior Escalation: Stalking behaviors often escalate over time, both in persistence and intrusiveness. The stalker's inability to find information online led to targeting Garnell's friends and engaging in physical surveillance, demonstrating adaptive and persistent malicious intent.

Technical Deep Dive

▶ Watch: Escalation: real-world impact and stalker's methods (10:00)

Garnell's presentation offers a compelling technical deep dive into the practicalities of both stalking methodologies and defensive countermeasures, grounded in her real-world ordeal.

The stalker's techniques illustrate a progression from basic online reconnaissance to sophisticated social engineering and direct physical surveillance:

1. Initial Digital Probes: The stalking began with the creation of numerous fake social media accounts. These accounts were increasingly realistic, often mimicking genuine profiles of Auckland-based girls and leveraging mutual friends to appear credible. The persistence of these requests, even after being declined multiple times, was the first red flag.
2. Covert Information Gathering: A pivotal moment was the appearance of a fake Instagram account featuring a previously unseen photo of Garnell with her date. This indicated covert photography in a public setting. The stalker then used this visual information to identify Garnell and her date, likely cross-referencing public social media profiles or leveraging shared connections. Garnell noted her privacy settings were stringent (no name on most social media, dog photo as profile picture, private accounts), suggesting the information was not easily gleaned from her direct profiles.
3. Leveraging Social Networks: The stalker exploited Garnell's social circle. By identifying one mutual follower (referred to as "Pear") between the fake accounts and Garnell's actual profile, and linking Pear to the ex-partner of Garnell's date ("Miss Tomato"), the stalker connected the dots. Miss Tomato's actual name was used for the initial persistent follow requests, indicating a blend of real and fake accounts in the reconnaissance phase.
4. SLI Strategies in Action:

• Surveillance: When direct online access to Garnell was blocked, the stalker shifted to monitoring her friends' social media to uncover information about Garnell's activities and friend group. This extended to physical surveillance, with the stalker attending Garnell's gym at the same times, showing up at an online Summer of Tech panel (despite not being registered), and appearing in her neighborhood during morning walks.
• Life Invasion: The stalker extended her reach to Garnell's professional network, creating fake LinkedIn accounts to stalk her work colleagues' profiles. A particularly unsettling instance was the creation of a Spotify playlist explicitly about seeing Garnell at the gym, attempting to communicate through this indirect channel.
• Intimidation: Friends reported seeing girls matching the stalker's description taking photos of Garnell at the gym. The repeated physical presence in Garnell's daily life, despite living "nowhere near" her, constituted a clear pattern of intimidation.
• Interference: The cumulative effect of these actions led to Garnell changing gyms (incurring an extra $14/week, or $56/month), turning off all social media for almost two years, and ceasing daily walks, directly interfering with her lifestyle and sense of security.

Garnell's defensive technical approach focused on digital hygiene and proactive self-assessment:

1. Digital Footprint Assessment (Self-OSINT): She recommends individuals conduct a baseline assessment of their own online presence. This involves Google dorking one's own usernames, emails, phone numbers, old gamer tags, and full names (e.g., "Bernie Garnell + Auckland," "Bernie Garnell + cybersecurity"). The goal is to identify all accounts, public information, and potential vulnerabilities.
2. Social Media Privacy and Security:

• Account Inventory: Identify all current and forgotten old accounts, as these can contain significant personal data.
• Privacy Settings Review: Meticulously check privacy settings on all platforms (e.g., Facebook's nuanced "friends of friends" or public settings) to control visibility of posts, friend lists, and personal details.
• Follower Monitoring: Regularly review who follows you and what information they can access.
• Information Sharing Audit: Assess what information is shared about locations (e.g., coffee shops, workplaces, neighborhoods, morning walks), close friends, and family. Crucially, consider what friends and family post about you.

1. Username Diversity: Avoiding the use of the same username across multiple social media platforms is a key recommendation. This prevents a stalker from easily cross-referencing a single username to find a person's presence on numerous sites.
2. Separation of Identities: Maintain distinct personal and professional online identities. While professional platforms like LinkedIn require full names, personal social media can be kept anonymous or pseudonymized.
3. Location Anonymity: Exercise extreme caution when discussing locations in public forums (e.g., Reddit subreddits like r/Auckland), as aggregating such information can reveal precise daily routines and residential areas.
4. Evidence Preservation: Maintain a rigorous system for evidence collection. Screenshots of all suspicious messages, profiles, and communications, especially when timestamped (e.g., within Discord or Instagram chats with friends), are invaluable for building a comprehensive report.

These technical insights underscore that while advanced tools might be used by attackers, fundamental privacy practices and diligent self-monitoring remain the most potent defenses.

Demo / Proof of Concept

▶ Watch: Self-protection: monitoring digital footprint and evidence (12:00)

Bernie Garnell's talk does not feature a traditional live technical demonstration or a software-based proof of concept in the conventional sense of a security conference. Instead, the entire presentation serves as a real-world proof of concept for both the methods of cyberstalking and the effectiveness of diligent digital hygiene and evidence collection.

Her narrative meticulously details how the stalker executed various SLI strategies (Surveillance, Life Invasion, Intimidation, Interference) using readily available social media platforms and real-world observation. For example, the creation of realistic fake accounts, the acquisition of a private photo, the monitoring of friends' social media, and physical presence at her gym and public events all illustrate the practical application of stalking techniques.

Conversely, Garnell's recounting of her own actions—meticulously taking screenshots of every interaction, using Google dorking to assess her own digital footprint, and maintaining records in timestamped chats with friends—demonstrates the practical application of defensive strategies. Her ultimate success in having the stalking cease after escalating the issue with comprehensive evidence serves as validation for the methods she advocates. Thus, the "demo" is the lived experience itself, providing concrete examples of how these abstract concepts play out in a high-stakes, real-world scenario.

Defensive Implications

▶ Watch: Practical tips, resources, and legal context (19:50)

Bernie Garnell's experience provides a stark reminder of the sophisticated and insidious nature of cyberstalking, offering crucial defensive implications for individuals, organizations, and the cybersecurity community.

1. Proactive Digital Footprint Management: Individuals must adopt a continuous process of self-OSINT. Regularly searching for one's own name, usernames, emails, and phone numbers using Google dorking or specialized tools can reveal publicly accessible information that could be weaponized by stalkers. This includes scrutinizing old accounts, gamer tags, and any data shared by friends or family. It's imperative to understand that privacy settings are not "set and forget"; they require periodic review as platforms evolve.
2. Enhanced Social Media Hygiene:

• Username Diversification: Avoid using the same username across different platforms to prevent easy cross-referencing.
• Strict Privacy Settings: Leverage the strictest privacy settings available on all social media. Understand who can see your posts, friends list, and profile information.
• Location Awareness: Be extremely cautious about sharing real-time or habitual location data, even indirectly (e.g., photos of local coffee shops, discussions in local Reddit forums).
• Separation of Identities: Maintain clear boundaries between personal and professional online presences.
• Educate Networks: Encourage friends and family to be mindful of what they post about you, as their public information can inadvertently expose yours.

1. Systematic Evidence Collection: This is perhaps the most critical defensive measure. Any suspicious interaction, message, or observation should be immediately documented. Screenshots of profiles, messages, and interactions, ideally with timestamps (as seen in chat logs), provide concrete, undeniable proof. This evidence is vital for reporting to authorities and establishing a pattern of persistent, unwanted behavior. A dedicated system for storing this evidence, separate from personal devices, is recommended.
2. Early and Persistent Reporting: Victims should be encouraged to report stalking incidents to relevant authorities (e.g., NetSafe in New Zealand, police, university security, HR departments) as early as possible, regardless of perceived severity. Even if immediate action is not taken, these reports establish a crucial official record, which can significantly expedite responses if the situation escalates. Garnell's regret about delayed reporting underscores this point.
3. Awareness and Education: Organizations and educational institutions should integrate comprehensive modules on cyberstalking into their security awareness training. This includes educating individuals about the SLI strategies (Surveillance, Life Invasion, Intimidation, Interference) to help them identify stalking behaviors beyond simple online harassment. Specific attention should be given to the psychological impacts and available support resources.
4. Organizational Support Mechanisms: Companies and universities must establish clear, accessible, and empathetic protocols for employees and students who report stalking. This includes providing guidance on evidence collection, liaising with law enforcement, and offering psychological support. The lack of proactive support from her university and initial police response highlights a systemic gap that needs addressing.
5. Advocacy for Legal Reform: The cybersecurity community should actively support legislative efforts to strengthen anti-stalking laws. Garnell's mention of the proposed New Zealand law, which would criminalize specific stalking acts and carry significant penalties, is a testament to the need for legal frameworks that keep pace with digital threats.
6. Understanding Stalkerware: Resources like those from the Electronic Frontier Foundation (EFF) on identifying and removing stalkerware are crucial. While not explicitly detailed in Garnell's case, stalkerware is a common tool for digital surveillance and merits attention in defensive strategies.

By adopting these multi-layered defensive strategies, individuals and organizations can significantly enhance their resilience against cyberstalking, transforming a reactive, victim-centric response into a proactive, empowering defense.

Key Takeaways

• Stalking is Often Subtle and Escalatory: Cyberstalking frequently begins with seemingly innocuous yet persistent intrusions, making it difficult for victims to initially recognize. These behaviors often escalate from digital reconnaissance to physical surveillance and psychological intimidation.
• Proactive Digital Footprint Management is Essential: Regularly conducting self-OSINT (e.g., Google dorking your own information) and meticulously reviewing social media privacy settings are critical for identifying and mitigating personal data exposure.
• Meticulous Evidence Collection is Non-Negotiable: Documenting every suspicious interaction with timestamped screenshots and clear records is paramount for reporting incidents and building a credible case for authorities.
• Early Reporting Creates a Crucial Record: Report all incidents, regardless of perceived severity, to relevant authorities (e.g., NetSafe, police, institutional security) as early as possible to establish an official history that can aid future investigations and interventions.
• Legal Frameworks Require Modernization: Current anti-harassment and digital communication laws may not adequately address the complexities of cyberstalking, highlighting the urgent need for specific, robust anti-stalking legislation (like the proposed law in New Zealand).
• Stalking Has Severe Psychological Impacts: Victims frequently experience significant mental health challenges, including anxiety, depression, PTSD, and even "reverse stalking" behaviors. Awareness and accessible support systems are crucial for recovery.

About the Speaker(s)

Bernie Garnell is a cybersecurity professional currently working at Safe Advisory. She recently graduated from AUT in 2024 with a major in cybersecurity. Known for her active presence in the community, she's recognized at events like Alandig, where she helps manage talk schedules. Beyond her professional life, Garnell describes herself as "chronically online" and even sells Kumra on weekends, where she's been recognized for her speaking engagements. Her personal experience with cyberstalking underpins her dedication to raising awareness and promoting online safety within the cybersecurity field.