Do what you can to limit your risks from hacking, identity theft, and exploitation.

DO THESE FIRST

• Use a unique password for every account.  

• Use passkeys and/or a good password manager to create and store strong passwords.

• Add multi-factor authentication whenever possible, including for email, banking, cloud storage, and social media accounts.  (Multi-factor authentication adds another step to verify it’s really you, such as a code texted or emailed to you, for authentication.) Consider not using products and services that lack security controls (multi-factor authentication, passkeys, etc.) for important tasks and data (banking, confidential information, medical records, etc.).

DO THESE NEXT

• Change factory-default passwords on internet-connected devices, including routers, cameras, smart home devices, baby monitors, medical devices, and other connected systems.  

• Create a “Personal Digital Protection Plan”.  Think intentionally about how you want to handle technology risk.  Make a plan for how you will respond to suspicious emails, texts, phone calls, and requests for money or personal information.  Protect (and replicate) information you don’t want to lose. Use the recommendations described here to try to get on top of problems before they start.

Limit the collection, sharing, exchange, and sale of your personal information.  Proactively control how your information can be used as much as you can.

DO THIS FIRST: 

• Think before you post.  Avoid sharing information online that would compromise your privacy, family, or expose personal or financial  details. Don’t put anything online that you wouldn’t want your grandmother or your future self to see.

DO THESE NEXT:

• Reduce unnecessary data collection by rejecting non-essential cookies and limiting optional tracking when you have a choice.  An ad blocker will also reduce (but not eliminate) online tracking and unwanted  advertising.

• Limit location sharing to apps that genuinely need it.  

• Review app permissions and privacy settings on major services regularly and tune them to what you are comfortable  with.  Options and defaults may change over time (including when they are updated).  

AI systems can generate useful outputs, but they do not possess human judgment, understanding, emotions, ethics, or accountability.  They are powerful tools, not our buddy.

DO THESE FIRST:  

• Verify AI-generated content with reputable sources and humans, especially in health, legal matters, finances, safety, employment, education, or other risk-prone situations. AI-generated content can be sycophantic, inaccurate, biased, misleading, confidently wrong, and sometimes dangerous.  Don’t rely solely on AI for high-risk situations. 

• Do not provide confidential or personal information (social security numbers, financial information, medical information, confidential work information, etc.) to chatbots unless you have a good reason to provide it and understand how the system will use the information. 

DO THESE NEXT:

• Use AI to enhance your learning, skills, and knowledge but not replace them.  Overreliance on AI can interfere with learning and skill development.

• Be cautious of sensational claims about AI— tech discussions in the media often emphasize dramatic benefits or dramatic harms.    Reality is usually more nuanced. Read a variety of reputable sources.  

Take the time to update devices, systems, and services and to clean up your digital environment.  Up-to-date systems are safer and less risky.

DO THESE FIRST

• Keep your devices, apps, and operating systems updated and install updates expeditiously.  Security updates often fix known bugs and reduce vulnerability.  

• Backup your computer regularly.  Regular backups can help protect from the consequences of ransomware, device failure, accidental deletion, etc.   Test your backups periodically to make sure they can actually be restored.

• Use the security protections built into your device and operating system and keep them turned on and up-to-date.  If you install additional security software, use a reputable provider.  

DO THESE NEXT

• Get rid of what you don’t want or use.  Delete accounts you don’t want or use.  Unsubscribe from unwanted services and emails.  Remove apps you no longer use.

• Keep multiple copies of important files and keep at least one copy somewhere separate from your computer.  Consider keeping a copy on an external hard drive, in the cloud, and/or in physical form (when possible).  When dealing with ransomware, an offline or otherwise isolated backup is particularly valuable. 

• Periodically review important accounts to ensure recovery email addresses, phone numbers, and backup methods remain accurate. Designate emergency contacts for your accounts and connected devices (e.g. emergency contacts on smartphones, inactive accounts / digital legacy on email, etc.).

• Separate your personal and work accounts, including bills, family communications, medical records, etc.

Most of us are not experts in the systems we use and need help to ensure our systems are as safe and secure as possible.  If you are a victim, sadly you are one of many.  There is nothing to be ashamed of.  Get help.

DO THESE FIRST:  

• Know where to go for expert help when you have a problem.  Experts who may be able to help you include:

  • The IT folks at work

  • Services offered by Senior Centers, Public Libraries, Neighborhood Groups, etc.

  • Official product support channels from companies who have provided you products or services (e.g. the Apple Genius Bar and its customer support number).

  • Consumer protection groups (e.g. state and federal consumer protection agencies and Attorney Generals).

  • Qualified local tech experts (e.g. services associated with computer stores in your town) and reputable tech organizations.

• Document everything you can about the specifics of a problem (where, when, links, screenshots, etc.).  This will help experts better understand what is happening. 

DO THESE NEXT:

• Know roughly where you might go for help before something happens so you can address problems quickly.  

• Make it a habit to learn from experts.  Some of my personal favorites include

  • [CONSUMER INFORMATION]  Stay up to date on consumer products.  Brian Chen of the NY Times is a great source of consumer technology advice.

  • [SECURITY] Sometimes you can take the content of a questionable text or email and search for it on the internet to see if it’s a known scam.  Krebs on Security and Schneier on Security are particularly good for this and good sources of practical advice.

  • [PRIVACY] The Electronic Frontier Foundation provides information and guidance on privacy, surveillance, and digital rights.

  • [AI POLICY] The Center on AI and Digital Policy provides information on AI policy and regulation.

  • [CHILD PROTECTION]  The Canadian Centre for Child Protection (C3P) provides important information on child exploitation and keeping your family safe.

Help yourself and your community stay safe online.  Learn to guard against scams. How you respond matters.  Even strong passwords and multi-factor authentication can be defeated if you voluntarily provide information to a scammer.  Common scams include (and there are many …):

• Phishing / impersonation scams:  An email or message that appears to be from a legitimate source  (bank, family, friend) intended to trick the recipient into providing sensitive information like passwords or credit card numbers.

• Romance / relationship scams  Scammers create a fake online relationship to gain an individual’s trust and persuade them to send money, share photographs, or provide other personal information.

• Sextortion:   Scammers coerce the victim into providing explicit images and then blackmail them for money or gift cards, additional content, or sexual favors.   

• Tech support scams:  Fake security warnings or calls to convince the target that their computer or account is compromised and ask them to provide remote access, credentials, or payment.

• Investment scams:  Fraudsters promise high returns or pose as financial professionals to gain trust and persuade people to transfer savings or retirement funds.  

DO THESE FIRST

• Stay alert for scams and do not click on questionable or untrustworthy links.  Don’t respond with information or money until you’ve independently verified who you’re dealing with – even if the request appears to come from someone you know.  

• When in doubt, stop.  Scammers often make their requests urgent.  Take a break and ask someone you trust before sending money, sharing personal information, clicking a link, or changing an account.   

DO THESE NEXT

• Help your parents and grandparents use tech safely and confidently.  Help them recognize scams, update devices, enable account protections.  Teach them to verify information before responding and how to recognize scams.  Older adults are often targeted by investment and other scams.

• Help protect your children.  Create age-appropriate controls for your children on social media and elsewhere.   You may want to create family rules for social media engagement, device use, screen time limits, and privacy controls.

• Help your children adopt safe online habits.  Help them understand the risks of talking to strangers, recording themselves, or providing personal or contact information.   Help them recognize (s)extortion scams and manipulation, think critically about social media and AI use, and understand online privacy.

Act quickly.   If you are exploited, phished, hacked, trolled, etc. online, you are a victim, and know that many people have experienced these kinds of problems in cyberspace.  Know how and where to get help and get it when you need it.  Do what you can to stay safe and know how to recover when something happens.  

ACTIONS TO TAKE:

• Change the compromised password immediately.  If you used that password anywhere else, change it there too.  Use a unique password for every account.

• Preserve evidence such as emails, text messages, screenshots, transaction records, and account notices.

• Enable multi-factor authentication.

• Check account recovery information to make sure it still is yours and turn on / restore alerts about new activity that exceeds your usage limits.

• Log out of the affected account on all devices. 

• Contact your bank and credit card companies.  If your social security number or other sensitive identity information has been stolen or exposed, consider placing a free credit freeze with the major credit bureaus.  A freeze can make it harder for someone to open a new credit account in your name.  

• Talk to an expert. Get help to identify the extent of the impact on your device, systems, and data. If your device is behaving strangely or you think the device is infected with malware, disconnect the device from the Internet and get help from a trusted expert.  Follow their advice about scanning or resetting the device as further investigation may be needed to determine what happened and how to fix it.   

• Notify affected contacts if your email or social media accounts are compromised;  attackers sometimes use your account to target others.

• Report identity theft at IdentityTheft.gov and follow its recovery plan. Depending on what happened, you may also want to report it to your bank, the police, the FBI's Internet Crime Complaint Center (IC3), or your employer or school's IT department.

Tech policy affects privacy, speech, safety, education, healthcare, labor, democracy, environmental sustainability, and many other aspects of modern life.  You can be an advocate for better tech at work and in your life.

WAYS TO ADVOCATE:

As a Citizen:

• Become informed about the tech policies, practices, and protections that matter to you.  Read about tech from a wide variety of reputable sources, take classes, ask questions, and seek a working knowledge of the tech you use and its impact on you and your community. 

• Contact your elected representatives  (congressperson / senator / city council member / state representative, etc.) and share your concerns and comments about tech issues, policy, and legislation.  

• Consider technology issues when you vote.  Check candidates’ stands on issues you care about and contact their campaign if that information is not available.

As a Consumer:

• Make informed and responsible choices about which tech products and services you choose to buy or use.  Before adopting a new technology, consider what data it collects and what security it provides.  

At work:

• Help create responsible data privacy guidelines / policies for your organization that protect the personal information of employees, clients, and customers.

• Promote AI literacy and safety in your business or organization:  Adopt a training program that helps employees use AI safely and effectively.  Provide guidance about when AI tools may be appropriate, when human review is required, and when AI should not be used.  Designate a knowledgeable individual or organizational group that can serve as a resource about when and how to use AI responsibly on the job for employees.

• Promote cybersecurity readiness in your business or organization:   Encourage your organization to back up critical systems and develop ransomware response plans.  Encourage regular employee training on phishing, scams, social media use, and cybersecurity practices.