Endless Thread - Thinking Outside the Dox: What 'consensual doxing' can teach us about internet privacy

Episode Date: July 25, 2025

Kristen Sotakoun (@notkahnjunior on TikTok) says she has always been 'the FBI of the friend group' – that person you can count on to dig up the juicy details on anyone's social media. It's a skillset that has earned her millions  upon millions of views on TikTok in a series she has dubbed 'consensual doxing.' In her videos, Kristen completes challenges from her viewers to find their birthdays, using only publicly posted information online. Kristen is now a handful of creators on TikTok who are making consensual doxing videos as educational content, encouraging viewers to think more deeply about what they post online, and where. On this week's Endless Thread, we dive into the world of consensual doxing, what it can teach us about our privacy, and host Ben Brock Johnson gets (consensually) doxed. Show notes: I got popular on TikTok by being a total creep (Business Insider) This Man Proves You Can Find Anyone Using Geolocation — and It's a Scary Lesson for All of Us (Distractify) ‘Consensual doxxing’ reveals the confronting truth about online privacy - you’re not as hidden as you think (7NEWS Australia)

Support for endless thread comes from Mathworks, creator of MATLAB and Simulink Software, to design and develop engineered systems, accelerating the pace of discovery in engineering and science. Learn more at Mathworks.com. Support for this podcast comes from Nature is the Solution, a podcast from The Nature Conservancy. This show tells climate stories like a stubborn optimist, because hope, innovation, and nature itself are key. to solving the challenges ahead. Follow on your favorite podcast app. WBUR Podcasts, Boston. Hey, y'all. Before the show starts, we just want to remind you that we set up secure lines for you to communicate with us.

If there's anything you need to share anonymously or very carefully in this time that we are living. Yeah, we have a proton mail account that is WBUR Secure Tips at Proton. or you can text or call us on Signal. That number is 646-456-9095. We should also mention that WBWR is an NPR member station and that the CEO of NPR, Catherine Marr, chairs the board of the Signal Foundation,

the nonprofit that supports the messaging app. Anyway, if there's anything you need to be in touch with us about and you want to be careful with how you share that information and protected. That's how you get in touch. WBUR SecureTips at Proton.m.m. Or call us or text signal 646-456-9095. I wanted to start by saying I stand by everything that you found. And I'm going to take some time to spend with my family. So by your family, do you mean your brother who's 10 years older than you or your mom who writes poems. She's found me out.

So, the other day, I got doxed. Doxed as in when someone posts your personal information online without your consent for malicious purposes. But before you get too concerned, this wasn't exactly that. Right. This doxing was consensual, which we understand. stand is kind of an oxymoron, but it's true, and it was done by a professional of sorts. My name is Kristen Soda Koon on TikTok. My username is NotCon Jr.

And I find people's birthdays who ask, and I do all of this based out of my favorite city in the world, Chicago, Illinois. Kristen, aka NotCon Jr., is the aforementioned professional of sorts. She's a TikTok creator who uses social media sleuthing skills to find out people's birthdays. And she shows her process step by step in her videos. Nobody freak out because, as Kristen says, she only finds the birthdays of people who ask her to. It's like a big game of social media hide-and-seek

that Kristen plays with her followers, a game that she scrolled into a few years ago. I was a server in the city of Chicago. I had no cybersecurity background. Just always have been the friend who is, the FBI of the group. And I was just scrolling on TikTok and this girl posted a video. And I didn't follow her. I didn't know who she was. And she said, don't she'll guess my age. And I said, well, I don't need to guess her age. I can probably

just go find it. So Kristen did what any friend group FBI agent would do and began to employ her thumb skills. Your Instagram was posted on your TikTok profile. If you go to your Instagram, you go to your tag photos on Instagram. A friend tagged you in a photo of a throw back Thursday, but you're all wearing formal dresses. It's like a high school. Another trademark of Kristen's videos is how fast they go by. So we're going to break it down a little. Basically, she finds this tagged photo of the formal dresses, and she figures that this was some kind of college sorority event. And in another post, the same friend who shared that

photo shared a picture of her old driver's license with the last two digits of her birth year showing. So she was born in 1992. If she's from Florida, but she tagged the photo of all of you in Montgomery, Alabama in formal dresses, I'm going to assume it was like a college event. So if you went to the same college and you were friends in college and you're the same age, you're like 30, 31. Bye. I posted it and I went to work at the restaurant that I worked at. And then I came home and looked at my phone and I said, what the heck just happened? This video blew up. And there was someone else who said, oh, this looks really fun. How about you try mine next? And thus, Kristen's internet niche.

was born. Leish McGeeh says, if you can find my birthday, I'll eat my hat. I hope you're starving, Leish McGish. You turned 40 on October 31st, 2022. Oh, J.D., you think because your profile picture is a truck that I won't find you. Well, guess what? My nickname is the bus driver. Why?

Because I'm about to take your ass to school. Your birthday's April 26, 1991. Happy birthday, Jays! Hale, 594. I know you think you were hidden away because your profile picture is Bob Dylan. but what if I told you Bob Dylan is the reason I found her birthday? Be birthday August 29th, 1985, Haley. Okay? Bye.

Birthday finding has gotten Kristen over a million followers on TikTok. The series is such a hit. She's been able to become a content creator full-time. She even accidentally added a new term to the real-world cybersecurity lexicon. So I made a playlist on my TikTok and I said, well, okay, what can I name this? Birthday doxing or something like that. And I said, okay, I'll just call it consensual doxing because I'm only doing it for people who ask me. I have never even said the words consensual doxing in a TikTok.

I just named the playlist that. And then all of a sudden, these news articles are coming out. These cybersecurity experts are like referring to my series consensual doxing. And I said, oh, my God. Experts like the National Cybersecurity Alliance, which has Kristen doing live consensual doxings as part of their seminars, which is pretty cool when you think back to the fact that Kristen doesn't have any professional investigative or cybersecurity background. And she doesn't use any official databases or even public records to help her find people's birthdays. Those tools are pretty widely available.

We journalists use stuff like that all the time. But no, all Kristen has to find her willing victims is her phone and the nosy disposition. Noisy disposition. Amory, you have another long-lost sister. there? I guess so. Kristen is my gal. But anyway, we wanted to know what can consensual doxing teach us about actual doxing and about how we might be unintentionally blowing up our own spots and each other's. I'm Ben Dox Johnson. I'm Amory Slooth Siebertson and you're listening to endless thread. Coming to you from WBUR Boston's NPR. Today's episode, Thinking Outs.

Inside the docks. How do you get ready to docks somebody? I have a specific corner of my couch. It's like the good corner, you know, when you get the good corner. And I tell my husband, hey, I'm not going to respond to anything that you say to me, probably, because it would be locked in scrolling on someone I don't know, social media for however long this takes me. And he's like, all right. It's nice to give him a warning.

That's nice. Yeah. I'm curious, what's the wildest goose chase you've been on? What's the hardest one that you've ever had to do? Oh, man. I think a recent one I did was this girl who she didn't have a picture on her TikTok. Her profile picture was just a cartoon. You want me to find your birthday, but you have a private profile.

That's really tough. If I'm here to destroy every single semblance of safety and security you have ever felt on the internet, are you ready? It was just a blonde, you know, blonde girl with class. cartoon that looked drawn, that kind of looked like it may be her. When I'm backed into a corner with info like this, the only thing to do is to Google your username. I got four results, and three were irrelevant.

But one led back to TikTok. I eventually got through her friends and her college. Someone tag your username and two other people in a caption. That TikTok with that caption has this photo. It's someone named Meg with glasses and blonde hair like that TikTok profile. picture. And Meg is wearing a University of Pittsburgh hoodie. But I could not figure out her birthday. Meg, I looked at every single family member's Facebook that you have. I am not joking. I was getting so angry because your family does post about celebrations. Is your dad on Facebook saying happy

Mother's Day? Who's your dad posting about you hugging a llama saying happy nine years going to camp? Here's your dad wishing himself. Happy birthday on Twitter. Here's your grandma posting about you having your first horseback ride. I've watched every single volleyball video of yours on every sports website that your dad has uploaded, hoping someone would say your aid. They were just celebrating everything except not saying her birthday. And I knew in my heart that this meant that her birthday had to be on a holiday because there had to be other things going on. I dug up her dad's alumni newsletter. And in the fall 2004 edition on page 60, it says that he and your mom welcomed a beautiful baby girl on December 31st, 2003.

Happy birthday, New Year's Eve, 2003, McGuire. Yeah, I said your full first name. I screamed when I found that one. So how long did that take you from when you started to when you were screaming with joy? I think that one took me about an hour and a half, two hours. Oh, my God, that's it? She is fast and furious.

I love it. I love it. And very funny. Like a natural comedian, natural comedic timing. Natural comedian who's blowing up your spot. A funny sleuth. Maybe she is. I would love for her to be my actual sister. Right.

One thing that's consistent is that Kristen's challengers all seem pretty confident in their ability to allude her. And they fail every time miserably. It's amazing. She finds them anyway. It's impressive. So impressive that Kristen's. got copycats? Or should we say copy monkeys?

She kind of inspired me to do what I'm doing in my videos. Hi, I'm Jose Monkey, and I find people who ask to be found. Jose Monkey is a stage name. We're going to refer to him that way because for right now, Jose Monkey is not interested in being found by you. Sorry. Jose Monkey is another TikTok creator. He's also friends with Kristen, aka Not Kong Jr.,

So the copying is flattery, not theft. The participation requirements for Jose Monke's content are similar to Kristen's, over 18, and full consent. But his methods are different. Instead of sifting through social media posts to find personal details, Jose Monkey relies on just small clues in a photo or video to find your exact location. I think we don't realize what an information-dense society we live in sometimes. There are always signs and bumper stickers and license plates and things like that around you that give information. One time I found someone because they were holding a very small dog.

As the video opens, we can see that there's a body of water behind this person and their dog. We can see that there's what looks like a path going around the body of water. Their video was quite difficult. There weren't a lot of stores. There weren't like signs. They were really not, you know, a lot of things like that. We can see what looks like a porta-potty across the way here, but I didn't think that would be too much help. Next we get a view in the other direction, and it's really just trees and grass.

It seemed like a park-type area. There was like a trail, and I believe there was like a dam or spillway or something like that. And guys, if that was all that there was to see here, I would have been very pessimistic about finding this place. But we've got one more clue. The dog had a rabies vaccination tag. Toward the end of the video, I was able to see a few frames where we can make out a phone number. I quickly discovered that that phone number is associated with the DuPage County Animal Services in Illinois. So I started looking around for trails in that area. I switched to the satellite view, and it didn't take a phone number.

and it didn't take me long to find this place that looked promising. We had a path around a body of water, and when I looked on the west side, it looked like we might have something that might be that spillway that we saw in the video. Guys, that was it. You were here near Maple Lake on the north central DuPage Regional Trail in Roselle, Illinois.

I surprised myself with that one. To date, Jose Monkey says he's found over 600 locations in 60 countries, which is coconut. Like he mentioned, Jose Monkey says, really strives to show you just how much we can unwittingly disclose about ourselves online. Kristen does this too, of course, but she also takes it a step further. If I'm going to go on Instagram, I'm not going to look through every single post you've ever made if you have thousands of posts. I'm going to scroll through your timeline and I'm going to see maybe you holding a balloon that has a number on it or a picture of a baby because that could be you as a baby.

People love to post themselves as babies for their birthday. You go to tagged photos and see a picture of you by yourself because your friend would say happy birthday to you and they would only post a picture of you. So Kristen is looking at not just your posts, but also the posts of people in your social network. Right, because even if you don't share a lot about yourself online, your friends who love you very, very much and just want the world to know, well, they might. And speaking of people who love you very much, there's someone even more passionate. about sharing your personal details on the internet. It is always the grandmas. It's always they post a picture of their grandchildren

and their friend comments. I've seen this like dozens of times. They'll post a picture and then their friend will say, oh, this is so lovely of your grandchildren. And then they will respond and say, thanks. Lucy is 12. Judd is 8. This was in 1996 when we were staying at this lodge for Christmas.

Like, it's so crazy to me. Oh, grandmas. I love a grandma. They're the best. But also, grandma, please don't, please don't post. We've talked, I think, on the show about this before, but I keep my kids off the internet. I store my digital photos privately. I don't post them. And it's been interesting over the last almost eight years that they've been in the world. How many times, you know, their photo has been inadvertently posted and published by friends or, like, groups or, you know, camp, it really happens even when you're really trying hard not to let it happen. Yeah, and it's really hard to undo those posts and the spreading of that information once it's out there. And it gets awkward to you, right? Like where you have to go to the person who posted

the thing and you're like, hey, man, I'm really sorry. You did this thing out of joy and you wanted to like share with the world this thing, but like I actually prefer you didn't. Yeah. You know what I mean? Yeah, so it's not just grandma's fault. It's maybe yours for having too many friends. There is a concept called context collapse. Casey Fiesler is an information science professor at University of Colorado Boulder. And she actually uses Kristen's videos to teach her students about context collapse. This is basically the idea that, like, in most people's kind of offline lives, there's not a situation in which, like,

Your boss would be interacting with your grandmother would be interacting with that girl who sat behind you in high school Spanish class. But this happens on social media a lot. Basically, imagine that your Facebook friends list is the guest list to the biggest party you've ever thrown. And at this party, your boss, your grandmother, and that girl from Spanish class are all doing shots together and gossiping about you. Just kidding. That's a nightmare I had once, I think, although I never took Spanish. It was Latin. Anyway. And there were no girls in Latin class, let me tell you. Oh, I was a girl in Latin class.

Really? You were my girl in Latin class? Yeah. Doing shots with your grandma, yeah. Anyway, the party represents how social media can blur the lines between your IRL social circles, which is context collapse in a nutshell. Your grandma would probably never hang out with your boss, but online, they sort of of due. And we're all used to this now. You know all these people. You added them on social media because presumably you want them to know a little bit about you. But what about the people in their networks? Right, because your friends and family might share something about you to their

own expansive circle of Facebook friends. And you don't have any control over what they post. You might not even know everyone who's going to see it. Which could be anyone, depending on people's privacy settings. Not Con Juniors videos, I think, are really striking examples of network privacy. And that's basically what this is. It's like privacy is not just individual, but is based on the people around you, the networks that you are part of. The big lessons are that it's usually the people around you that become the people. the sort of failure points as related to privacy. All social media platforms have the potential for context collapse to occur.

But there is one platform in particular where Notcon Jr., Kristen, notices people making all kinds of disclosures. People treat Facebook as a private Instagram profile or a Snapchat that goes away. But Facebook is so permanent. And I think that Facebook is the least safe out of all of the apps. because you can just search anything on there. Yes, but Casey says Facebook's interface isn't solely to blame either. I don't actually think this has anything to do with the way that Facebook is, it's the norms about how people use Facebook. Which, to be fair, their design has encouraged these norms, right?

But the fact that people use their real name, the fact that they are prompted to share information like birthdays and marital staff, and where they live and these sorts of things. It changes the way that people use the platform. So Facebook's design encourages oversharing, and we sheeple, humans, we oblige. Oh, God. Which makes Facebook a treasure trove of information for someone like Kristen. How exactly does she do it?

We're about to find out step by step. Yep. Coming up after the break, it's time for me to get doxed. Consensually. At Radio Lab, we love nothing more than nerding out about science, neuroscience, chemistry. But we do also like to get into other kinds of stories, stories about policing or politics, country music, hockey, sex, of bugs. Regardless of whether we're looking at science or not science, we bring a rigorous curiosity to get. get you the answers.

And hopefully make you see the world anew. Radio Lab, Adventures on the Edge of what we think we know. Wherever you get your podcast. Support for this podcast comes from Is Business Broken? A podcast from the Mayrotra Institute at Boston University. On the show, host Kurt Nickish asks the thorny questions necessary for this moment about the role business plays in society. Questions like, why are executives paid so much?

Why is innovation and health care so hard? Is ESG just greenwashing? And of course, is business broken? Follow is business broken wherever you get your podcasts. There is something powerful about the sound of the human voice. Beautifully produced audio has the unique power to connect and inspire. Tell your organization's story with a custom podcast from City Space Productions, the creative studio from WBUR's Business Partnerships team.

Become a thought leader. Recruit new talent. Reach new audiences. Whatever your goal, we can help. Discover how the magic is made at WBUR.org. org slash creative studio. So yes, we asked Kristen, aka NotCon Jr., to Doc's Ben, consensually.

And not only was she up for the challenge, she, in fact, wanted to make it more challenging. I wanted to find your age only using things that you yourself have said. So I knew that I could avoid Facebook because on Facebook, I will find people's birthdays very easily because people will wish them happy birthday, right? So that was a no-go for me. You have an open Instagram. It is not private.

Lucky for me. It's not very active either. Not very active. But it used to be active, right? And I wanted to get a general gauge of your age. And that was really helpful from a 2014 post where you said, were in Godspell in high school. It was a throwback. That is true. Nobody gets to see those pictures. I'll say that. Oh, I've seen one. I've seen one. So you have a picture with your dad

from 2014 that says, Love You, Dad. And you post a lot about your mom and how she writes poems and things like that. So I have this whole aggregate of your family. I could not find any indication of your birthday. But luckily, luckily, I have all this information already, and you posted your Twitter link, excuse me, X, the everything app, in your bio on Instagram. Yep, link in bio. Yep. Guilty is charged. And the greatest thing for me when I'm finding these birthdays is when I go to someone's X slash Twitter and it says that they joined a long time ago. And you joined in March 2010, because that means to me that I can look through your,

I can search keywords and I'm going to find things about you. I got to delete X. Don't we all, don't we all though. Yes, we really do. Yes, we do. Obviously, I look up the words birthday on your profile. So on July 28th, 2014, you said, Google Doodle changed just for me.

This is scary tech. and you posted a screenshot of the birthday animation that Google does on your birthday. And then you replied to someone and said, my trolling for Twitter birthday wishes totally worked. But you could be joking, right? Also, you used the word troll, so I was worried that you were not telling the truth or you had changed something or something like that, right? Fair, yeah.

I went back to your Instagram, and usually when people don't want to post about their own birthdays on Instagram, they will still post other pictures. In 2019, you posted four photos on July 29th. And all on Instagram, separate posts. What an annoying Instagram move. But it says a lot, right? It says a lot because to me, that says you're excited about things you wanted to share

a cool thing that happened to you. I looked up July 29th, 2019. It's a Monday. So it must have meant, to me, it meant you had a fun weekend. July 27th, you posted with three of your friends. And you said met one in middle school, one at the first job, one at college, and one in high school. And I said they had to be there to celebrate your birthday.

But I couldn't find the year, right? I had to go back to Twitter slash X for the year. I looked up the word old. And in 2022, May 30th, 2020, you said, I just stopped to let a couple of 10-year-olds use the crosswalk. And I gave them the gnarliest hang loose. This 41-year-old could muster. Oh, busted. Wow.

So with all of that put together, I'm going to guess that your birthday is 19. You are fully correct. Well played. I have to say, I was pretty, I was floored. Yeah. I expected her to poke more fun at me than she did, considering her other videos.

So I feel like she was very, it was the softest, gentlest, consensual doxing, I feel, and I appreciate that. So we had a lot of fun doing this, but some people out there might not feel so warm and fuzzy about what they just heard. Yeah, Kristen's consensual doxing videos are all very funny and lighthearted, but we live in a reality that is just a lot darker. Doxing, by definition, is a malicious act, and it can put people in real danger. That fact isn't lost on us or Kristen. People think it's fun to message me my address or they think it's fun to message me the name of my family

because I have been doing that online. I think they miss the consensual part of my consensual boxing series, you know. I get comments and I hope people are kidding sometimes when they say, oh, this helped me stalk my ex. Thank you so much. You know, I'll get things like that. But I like to think I'm doing more good because people who see it, hopefully, that makes a lot of people be more mindful of what they post online going forward. Both Kristen and Jose Monkey, our consensual geolocator doxer, say the point of their content is not to make people stop posting entirely.

They just want us to be making more intentional decisions around what we post on social media, whether it's about us. or someone else in our lives. Because in our context-collapsed world... Remember that to someone else, you're the third party who's revealing their information. And that's the thing I think I'm really taking out of this. It seems like if we can all collectively make just small changes to our own behavior on social media, we can actually keep each other a lot safer. Where do we draw the line, though?

Human connection and friendship are some of the best things the Internet has to offer. and some of our favorite things to talk about on this show, and some of Kristen's favorite things when she's deep diving into her Doxie's social media profiles. I feel like I'm getting to know somebody and getting to know who they love and who they cherish. And Ben, you just seem like you have a lot of people who love you and you love your family.

And that's all I got. That's all I got from all of this. I didn't find anything sus. But unless you're doing suss things all over Facebook, I know nothing about that. No, no, on Reddit. He's doing them on Reddit. It is true. All of my shit posting is on Reddit. That's true. That's fair. What does this make you think about? I mean, it makes me think about that the internet is forever and we have to remember that because it's just like we think of it as ephemera and we are trained to think of it as ephemera and just share with the world without really thinking that that lasts forever and can potentially be used against us. And I don't like, just to say this, like, I don't think Kristen's

point or Jose Monkey's point is to assume malintent. You know what I mean? Like I don't, like, I'm not a believer in stranger danger as like a widely, is like a massive problem. But like being aware and being careful when you are moving through a world where there is danger, I think is valid. So like, I'm not saying don't be open. I'm just saying be intentional, right? And I think that's what Kristen and and Jose Monkey are also advocating for us. Just like, don't put the bar on the floor when you're thinking about what to put online. Think about it. Yeah, for me, it's just like, check my privacy settings on all of my social media pages, step one.

And step two, just treat every little comment and post like anyone will find it whenever they want. Step three, have a talk with Graham, Graham. Graham, Graham, all the gram-grams of the world. Please, please stop lovingly spilling all of your family's tea on your Facebook. Start an only-fans account. Only grams. Only grams. Endless thread is a production of WBUR in Boston.

This episode was co-hosted by me, Ben Brock Johnson, and also Amory Sebertson. It was produced by Franny Monaghan. Mix and sound design by Emily Jankowski. Our managing producer is Samata Joshi. The show is edited by Meg Kramer. The rest of our team is Dean Russell, Grace Tatter, and production manager, Paul Vigis. If you have an untold history and unsolved mystery

or other wild story from the internet, you want us to tell. Hit us up. You can email us, endless thread at wbUR.org. All right, I'll see you on only grams in 40 years.