Social Steganography: Learning to Hide in Plain Sight

[Posted originally to the Digital Media & Learning blog.]

Carmen and her mother are close. As far as Carmen’s concerned, she has nothing to hide from her mother so she’s happy to have her mom as her ‘friend’ on Facebook. Of course, Carmen’s mom doesn’t always understand the social protocols on Facebook and Carmen sometimes gets frustrated. She hates that her mom comments on nearly every post, because it “scares everyone away…Everyone kind of disappears after the mom post…It’s just uncool having your mom all over your wall. That’s just lame.” Still, she knows that her mom means well and she sometimes uses this pattern to her advantage. While Carmen welcomes her mother’s presence, she also knows her mother overreacts. In order to avoid a freak out, Carmen will avoid posting things that have a high likelihood of mother misinterpretation. This can make communication tricky at times and Carmen must work to write in ways that are interpreted differently by different people.

When Carmen broke up with her boyfriend, she “wasn’t in the happiest state.” The breakup happened while she was on a school trip and her mother was already nervous. Initially, Carmen was going to mark the breakup with lyrics from a song that she had been listening to, but then she realized that the lyrics were quite depressing and worried that if her mom read them, she’d “have a heart attack and think that something is wrong.” She decided not to post the lyrics. Instead, she posted lyrics from Monty Python’s “Always Look on the Bright Side of Life.” This strategy was effective. Her mother wrote her a note saying that she seemed happy which made her laugh. But her closest friends knew that this song appears in the movie when the characters are about to be killed. They reached out to her immediately to see how she was really feeling.

Privacy in a public age

Carmen is engaging in social steganography. She’s hiding information in plain sight, creating a message that can be read in one way by those who aren’t in the know and read differently by those who are. She’s communicating to different audiences simultaneously, relying on specific cultural awareness to provide the right interpretive lens. While she’s focused primarily on separating her mother from her friends, her message is also meaningless to broader audiences who have no idea that she had just broken up with her boyfriend. As far as they’re concerned, Carmen just posted an interesting lyric.

Social steganography is one privacy tactic teens take when engaging in semi-public forums like Facebook. While adults have worked diligently to exclude people through privacy settings, many teenagers have been unable to exclude certain classes of adults – namely their parents – for quite some time. For this reason, they’ve had to develop new techniques to speak to their friends fully aware that their parents are overhearing. Social steganography is one of the most common techniques that teens employ. They do this because they care about privacy, they care about misinterpretation, they care about segmented communications strategies. And they know that technical tools for restricting access don’t trump parental demands to gain access. So they find new ways of getting around limitations. And, in doing so, reconstruct age-old practices.

Ancient methods

Steganography is an ancient technique where people hide messages in plain sight. Invisible ink, tattoos under hair on messengers, and messages embedded in pictures are just a few ways in which steganography is employed. Cryptographers are obsessed with steganography, in part because it’s hardest to decode a message when you don’t know where to look. This is precisely why spy movies LOVE steganography. Of course, average people have also employed techniques of hiding in plain sight for a long time, hiding information in everyday communication, knowing that it’ll only be interpreted by some. Children love employing codes and adults generally pretend as though they can’t understand pig Latin or uncover the messages that children hide using invisible ink pens purchased from toy stores. Yet, as children grow up, they get more mature about their messaging, realizing that language has multiple layers and, with it, multiple meanings. They often learn this by being misinterpreted.

What fascinates me is that teens are taking these strategies into the digital spaces, recognizing multiple audiences and the challenges of persistence, and working to speak in layers. They are not always successful. And things that are meant to mean one thing are often misinterpreted in all sorts of the wrong ways. But that doesn’t mean teens aren’t experimenting and learning. In fact, I’d expect that they’re learning more nuanced ways of managing privacy than any of us adults. Why? Because they have to. The more they live in public, the more I expect them to hide in plain sight.

Image credit: Jon McGovern

(This work is licensed under a Creative Commons Attribution 3.0 Unported License.)

Print Friendly, PDF & Email

50 thoughts on “Social Steganography: Learning to Hide in Plain Sight

  1. CGHill

    There are people who are shocked to discover that I have my real name on my blog, my Facebook account, and even my Twitter account: what could I possibly be thinking? My reasoning, though, is simple: if I don’t appear to be secretive, it will create the illusion of transparency, and those who would otherwise discern my secrets will decide that I don’t have any secrets worth bothering with. The message is equally fuzzed up, but in a different way.

  2. Saqib Ali

    hmm Social Tagging could be a problem for Social Steganography. Imagine if Carmen’s friends had tagged her facebook post to reflect its true meaning…. devastating for her mother…..

  3. Erika

    Why don’t you even mention that teens could be using Facebook’s privacy settings to publish to a custom list of friends for each and every post they make? Are they unaware of this option? Are they forgoing for any particular reason? Considering your blog’s usual depth and scope, I’m really disappointed that this wasn’t even briefly touched on.

  4. Mike

    danah-
    What advice do you have for parents? Should we “friend” and monitor for social steganography or not friend and monitor in some other way? As a parent of a tween, I feel the need to monitor to make sure my child is safe in the online world.

  5. baruk

    hi danah, am a bit of an rss lurker, dragged into the open by this post. i think this is an interesting introduction/angle to the steganography thing, and am sharing. will keep a closer eye on your feeds, thanks!

  6. Mike Lewis

    Great post danah.

    This is definitely the future. When all content is public, or is assumed to be public then you need to hide in plain view and rely much more on context. There are lots of new techniques for the management of your online persona. Cloaking is one as is the pushing of lots of positive information out rather than trying to hide everything. It seems that more information on the web (even cryptic info) is better than less.

  7. Darcy Moore

    “Children love employing codes and adults generally pretend as though they can’t understand pig Latin or uncover the messages that children hide using invisible ink pens purchased from toy stores. Yet, as children grow up, they get more mature about their messaging, realizing that language has multiple layers and, with it, multiple meanings. They often learn this by being misinterpreted.”

    A great post and one that English and History teachers could make use of to explore a whole range of texts with students. What fun, what good conversations, how useful.

  8. Hazel Edmunds

    Answer to Mike: you can check all you want to but it won’t stop a secretive 13-year-old hiding what s/he wants to hide – and believe you me they are very good at it.

  9. Enrico F

    @Mike I try to answer.
    I think that what Danah describes is a very smart act of intelligence and culture. It’s nothing about technology, it’s about language. It’s nothing new, anyway, as Danah tells us.
    Language used craftly. Parents must be as smart as their kids, that’s the answer. They must over-reach. They have to learn between the lines, and over the lines. They – oh my, I’m doin’ it simpler than it is – they have to know about the lyrics and about the movie and about the feeling it expresses.
    They have to use the same strategy: understand things from a safe and hidden point of view, like a bird-watcher. Vigilant from a distance.
    The “problem” here is that Carmen proves herself wiser than her mother, but not because she uses Facebook more properly, rather because she uses language and communication in a very sofisticated way.

  10. Thomas Bachmann

    I like your article very much! Sometimes I think social steganography already happens in the unconscious of teens. I wonder what would happen if facebook made it easier to post status updates to certain groups. Would teens do the extra effort to select the recipients or would they still encrypt their messages? I assume they will still encrypt messages since they don’t want to forget anyone to tell. Additionally it adds a kind of mystery to their profiles which could make it more interesting to others.
    But it social steganography a good thing? I mean it’s happening also in the offline world where teens speak a different language when they are amongst each other, using inside knowledge and slang. What side effects can resulting misinterpretations have?

  11. Silona

    WOW

    Laughing outloud at myself in regards to this. Did the same thing and posted a song when when A and I broke up (still friends btw.) My close friends got it – most others didn’t. It mostly worked for me – but was also sad about the others that didn’t get it… in an odd way (and not logical way) I didn’t feel heard…

    The problem is with the blend btn social, romantic and business in social media. Actually, my personal issue is just the romantic/business interaction makes me extremely uncomfortable.

    I so miss the friends’ groups on Live journal!!! I could divide things up in regards to context. I miss the indepth threaded discussions on my inner world w 73 close friends that live around the world… Nothing else enables that for me right now 🙁

    it was kinda like crowd sourced therapy… and help me though some very difficult times.

  12. Ed Schipul

    I like the analogy of Steganography, but perhaps it is bigger than that. Steganography suggests to me a smaller series of coded messages (troops amassing on the western front!). My observation of my own kids is that their use of Facebook falls more into what Edward Hall calls “high-context communication” where the bulk of the “information is either in the physical context or internalized in the person, while very little is in the coded, explicit, transmitted part of the message.” (Beyond Culture, pg 91)

    Perhaps Carmen isn’t hiding a particular message, although certainly the message was hidden. But perhaps it is that she is living in two cultures simultaneously and only her high-context culture friends can understand her messages at all. She is in fact counting on the misinterpretation by low-context “friends” on FB to live a double life, or at least maintain a private green room in plain sight.

  13. barf

    ENGLISH SPEAKER DISCOVERS DOUBLE ENTENDRE

    FILM AT 11

    only on facebook is this kind of discovery surprising. jesus christ, really? you learned to conceal one meaning beneath another? would you like a cookie?

  14. Ben Kunz

    This raises implications for social media sentiment-monitoring systems such as Radian6. If we all use nuance to some extent to communicate at different levels to different people, automated systems that try to judge the vibe of a social topic must have errors. Parsing irony has already been difficult; how will computers dissect double meaning? I think I hear marketers groan.

    On another level, we have to admire the creativity of humans to bend tools to our will — misrepresenting communication to say what we really mean.

  15. Peter A.

    danah and all,

    The tactic is not new at all, but seeing it in wider use in the real, albeit virtual, world (as opposed to the world of literary fiction) is a little bit frightening. Orwellian society is coming closer and closer. This reminds me particularly of the 1984 (sic!) novel of Janusz A. Zajdel, Polish S-F writer, titled “Paradyzja” (English: “Paradise, the World in Orbit”) in wich a totally invigilated society develops massively metaphoric and sometimes poetic language (“koalang”) that conveys secret meanings discernable by people yet unparsable for the omnipresent automated eavesdropping system.

    I have no idea if the book has been translated into English (but Wikipedia article stating the English title suggests it), but it is entirely worth reading.

    http://en.wikipedia.org/wiki/Paradyzja
    http://en.wikipedia.org/wiki/Koalang

  16. Carmen

    When she talked about Carmen hiding in plain sight, I thought “Where in the world is Carmen S?”

  17. StCredZero

    I had a college friend who would always say exactly what was on her mind. She’d come out with something like, “Oh, you’re intimidatingly cool. I don’t think I’m radical enough to hang out with you in your leather jacket and chains.” Everyone thought she was some kind of hyper-sarcastic acerbic wit, but actually she was always just plainly saying what was on her mind. Sort of like Peter Sellers in “Being There.” Anyhow, that’s kind of the opposite of the “social steganography” described in this article. Instead of a subversive meta-message posing as a straightforward message, you have straightforward statements being taken as subversive meta-messages.

  18. Emily

    Now, a name for what I did all through high school; thank you danah boyd!

    I should also note that that was about 5-9 years ago now (totally dating myself, but eh, that’s ok), so I would definitely not call this a facebook phenomenon or anything necessarily “new” in the digital space.

    Nevertheless, it is an important phenomenon (I think) and one not often discussed.

  19. Sean D. Fertigoyim

    hey peter a — news flash for you — LITERARY FICTION EXISTS IN THE REAL WORLD!!!!!!

    in terms of “reality” of it, blog-o-verse is largely literary fiction, just not edited and filtered.

    becuase it is so e-z to partysip8.

  20. Wolfger

    This is more an example of a double entendre than of steganography. And it’s a horrible example of how to hide something from someone on FB. Understanding and using FB privacy settings is much more effective.

  21. Mary Jane

    Hey, what you are doing at 4:20 today? I’m meeting my friend Tina, want to join us skiing?

    Turns out drug users are all actually professional steganographers! And BTW, I’m a friend of Bill W, we’ll be sure to discuss steganography at our next meeting.

  22. Winston Smith

    @CGHill: I use my real name too, but for exactly the opposite reason. I do it to create the illusion that I’m creating the illusion of being open and transparent. If I don’t appear to be secretive like everyone else, then it will appear that I’m trying just a little to hard to be nonchalant, so I *must* be hiding something. Then everyone tries to find secret messages in my posts about what my cat had for lunch, instead of commenting on what a loser I am if that’s all I have to post about.

  23. Milan

    A related technique is generating large quantities of benign, unobjectionable material that is linked to your real name. That way, when sombody Googles you they will come across something that paints you in a relatively good light.

    This approach is related to steganography, insofar as it helps to conceal potentially sensitive information within a larger mass of benign information.

  24. Karthik

    Almost all teens have the ability to obfuscate to remain in flat in the public, but reveals different meaning if interpreted in the sense it was authored. I feel that everyone has the knowledge to create and interpret others to know whether it makes any sense to them. It becomes a necessary way of communication in a world full of complicated relationships.

  25. Jane Smith

    @Peter A./Mary Jane et al: Exactly, poets in countries with repressive regimes do it all the time. Drug users/mobsters rely heavily on double entendre too. Heck, in poesy most of the fun is that you can read between the lines…

  26. PS

    It reminds me of IM and txt lingo. “PIR,” “POS,” “PAW,” and “KPC” all look innocuous, especially if the clever user can come up with an alternate meaning if interrogated.

  27. Kevin Lyda

    But this has been happening forever in human conversations. It’s amusing to watch, but surely it’s not surprising to see in digital form?

  28. zephoria Post author

    Richard – you’d be surprised at how often teens embrace “classics” in film and music. And in this case, we’re talking about a geeky girl who consumes classic geek texts along with her friends as a form of geek street cred. (I was delighted to find that Monty Python persisted among a next gen of geeky teens.) Conveniently, her parents aren’t American/British and don’t share this reference point at all, even if they are old enough to do so.

  29. Richard

    When our kids were small, if they heard the word “McDonalds”, we had to go or argue for far too long.
    So if we were in the car and considering it, I would ask my wife if she wanted to visit the “Caledonian dining establishment”.

    By they time their vocabulary improved enough to get the reference, they hated the place, so that form of steganography was no longer necessary.

  30. Jon

    Zephoria – is Carmen’s mother also unable to use Google? Are none of Carmen’s FB friends going to comment in a way that might be revealing? If the lyrics aren’t a big enough tipoff, then the Wikipedia article in result #3 might tipoff a paranoid mom. Depends how obsessive she is, I suppose.

  31. Andy

    I always text my mate with

    @RT, have bomb
    or
    @RT, bomb gone off

    which means that I’m in the usual pub and they are either serving (or not) the real ale Bombardier that day.

  32. zephoria Post author

    Jon – the key to steganography is that you don’t realize that there’s a code hidden there in the first place. Of course she can use Google to find that those words are lyrics and that those lyrics connect to “Life of Brian” and … but most people who see teens’ posts don’t necessarily even parse them as lyrics let alone start making the connections. This is just one of many posts that fly by so unless you’re super concerned and are desperate to find out, you don’t bother. Interestingly, teens will also tell me that people do often try to read too much into things they post and end up misreading it the same, thinking there are codes there when there aren’t. So it goes in every which direction. But steganography (in the classic sense, not the modern crypto sense) is not about not having the skills to decode something, but not realizing there’s a code there in the first place.

  33. Rebecca

    There really is nothing new under the sun, just the generational manifestation. Many ancient people lived in public, as the concept of private spaces is relatively new. The difference is how vast the concept of “public” has become, allowing unknown others into a much larger Public. Few of us understand the implications, fewer are adept within the new, larger, unbounded Public Space, and teenagers may be, paradoxically, the most active (which is often misinterpreted as adept)and least aware.

  34. Bill

    Hi Danah. This is a really neat article. I happened upon it in google reader. I’ve become fascinated with steganography over the past couple of months, so I decided to stop on by. I never really thought of language itself as a method for stego. Would you consider inside jokes as part of the social steganography realm?

  35. Jonadab the Unsightly One

    Mike: If your kids are physically with (one or more of) their parents most of the time, then what they don’t reveal to you on Facebook isn’t such a big deal. OTOH, if your underage children spend more time on Facebook than they spend with you, you have a much bigger problem than anything this article addresses. Don’t be an idiot: put the computer(s) in the family room, not the bedrooms.

  36. Cindy Carpenter

    Fascinating concept. It reminds me of linguistic code switching, from Noam Chomsky’s work.

  37. Jessica

    It seems that a very similar thing happens on Facebook within the semi-closeted queer community, particularly with regard to interests (music, books, movies). While mentions of queer media may readily slip by second cousins and great-aunts, the artists/authors/filmmakers routinely referenced are known well enough to catch the attention of those looking for such things.

  38. Eddie VIII

    african american spirituals anyone?
    river jordan = ohio river
    drinking gourd = big dipper
    etc.

    the complete history of rock n roll anyone?
    tutti fruity oh rudy
    oh! she bop

  39. Georges

    Hello danah – there seems to be a kind of “privacy violation” here since you’ve just revealed to the mothers of millions of Carmen, out there, that their children do use steganography. Don’t you think that after the great article, parents will read their children’s post as steganography-coded?

  40. hwk

    to Mike:
    maybe monitoring is the wrong way. a child is not a technical device or a process that needs to be monitored.
    educate your children and you should be able to trust them. your children have to learn how to stand on one’s own feet and a father monitoring them and making “sure my child is safe in the online world” (or: the world) is not helping them. there is no guaranty that nothing will every harm them in their lifes (with or without their father) but they have to solve their problems on their own, make their mistakes ….
    if they realise, they’re being monitored they will be very disappointed an lose confidence.

  41. Diana

    Re:Georges,

    Congratulations, you win the award for the biggest idiot out there. I hope you didn’t go to college, otherwise, I must say it was a huge waste of money. Even if parents will see messages as encoded, danah was simply making a journalistic point/discovery; it isn’t up to her how people interpret what she writes, nor is it the case with any journalistic article or scholarly paper you might read online. Also, the article is addressing yet one more branch of basic psychology so I would say that none of it is rocket science. At the same time danah does a masterful job of analyzing this information and bringing it to the masses.

    Ta ta.

  42. MR

    Amazingly interesting. History nuggets are my favorite type of nugget. I don’t think I’ve ever used steganography online, although I use it all the time offline because I have a twin sister 😛

  43. Bas

    @Erika
    August 23rd, 2010 at 12:24 pm
    Because it does not exclude 1 (or more) person. It just includes a limited number of people. So it’s a lot of work. And speaking in code is more fun. (Just guessing here 😉

    Mike
    August 23rd, 2010 at 1:09 pm
    Don’t, your kids have a right to privacy. You feel a need to protect them. That’s natural. But you protect them from the wrong people and from the wrong fears and blasting away their privacy is the best way to loose their trust and them trying to hide more and more from you

  44. Artur

    Hmmm.

    If this is about security, then it seems quite naïve to me:

    – It does not help about the primary adversary, namely Facebook itself. The latter does not care about specific content as much, as it cares about the social links. We are whom we know.

    – Steganography and especially this “social” steganography and cryptography are different in the sense that there is no parameter that can be easily changed later so as to better protect the sensible data: the key is missing, the algorithm becomes the key. This is typical security by obscurity kind of thing. It’s probably just fine for ephemeral communications. So, if Carmen was talking to her friend in person, while her mother was standing at her side, then it would be a good strategy. However, if the message is stored somewhere, and the content remains sensible for a longer time, then revealing the “hiding algorithm” at any time is a security nightmare. This is exactly the case here: Facebook will store this info for ages. Any side note, remark, tag, additional reference by Carmen herself or by any of her “knowledgeable” friends (who do not care about the data that much – an essential point as well), will uncover this information to everybody who cares, i.e. in particular Carmen’s mother.

    All in all, it seems to me that this is no good as a security mechanism. It sounds like another proof that privacy settings need to be improved, that it is essential to be able to post messages only to certain people, that we need working implementations for ephemeral communications, and that we need to get rid of central authority overseeing all communications (facebook, in this case – not the mother :-))

  45. Georges

    @Diana
    Sorry if you’re not smart enough to understand what my post was about. And by the way, you shouldn’t call people names. That is what I think id “idiot”. ta ta.

  46. Vivien

    I’m a student interested in doing my research on social steganography, but have been having trouble looking for articles online.
    Can anyone point me in the right direction to related articles on this topic?
    Thanks so much!

  47. Waldo

    While it may require more time online, were I a teen I’d create two distinct profiles. One censored that told the stories mothers and future bosses want to hear. The other, perhaps bypassing facebook, a blog for example, would be uncensored. Facial obfuscation would be strongly advised in the beer bong, bowl smoking, privates flashing, etc.
    Security through obscurity is another way of expressing steganography. As I think my initial idea through to practical application: a little digging would reveal the guise. Known friends who would likely not participate would blow the subjects cover.
    How old is the girl in the story? Mom seems overbearing and not very thoughtful of her daughters independence. Like they don’t see each other every day? She’s feels the need to comment on every post. Perhaps a short course in Facebook etiquette is in order.
    Ahh, who cares anyway. No wonder her boyfriend dumped her.

  48. Jessica

    Parents and kids have always played an elaborate game of hiding information from each other. It’s great for kids’ brains to think up ways to keep the adults out of their business–and the adults know more than the kids think. And, to be frank, the kids often understand more than the adults prefer to think about. We all hide things from various people in our lives–not just kids. I don’t want my kids to know everything about me. And I don’t think I need to know everything about them, even to keep them safe. Language and its myriad uses are so fascinating!

Comments are closed.