Anonymity for published writers and users with a heavy online presence is quickly becoming a thing of the past, as writer Kelsey Piper warns that Anthropic’s Claude Opus 4.7 managed to identify her based on a brief passage of unpublished work — while logged out and using incognito mode.

Vox writer Kelsey Piper, who champions anonymity, conducted some tests on Anthropic’s Claude Opus 4.7 last week and quickly learned that her usual safeguards, such as logging out, using incognito mode, and omitting saved preferences and memory, didn’t prevent Claude from pinpointing who she was almost immediately — based on 125 words from an unpublished political column.

This is particularly alarming given the news that Anthropic’s latest model, Mythos, has the capability to hack into nearly every computer in the world, and it’s not being released to the public for that reason, as SFist reported last week.

To rule out the possibility that the system was accessing hidden user information, Piper asked a friend to repeat the test on a separate computer and got the same result. She also ran it through the API, again with no identifying context, and received the same answer each time.

While she notes that narrowing down an author from a political column isn’t that difficult, especially given Piper’s public body of work, the model reached the same conclusion across unrelated and unpublished material, including a student progress report, a movie review, fiction, and a college application essay. She said other models weren’t nearly as accurate, although ChatGPT successfully pinpointed her some of the time.

When she asked Claude and ChatGPT for justifications for their answers, she said the explanations were often off-base. She suspects they were generated after the fact, with the models identifying patterns in writing and then retrofitting a narrative to justify the result, despite not actually understanding how they reached it.

Piper also did some testing on her friends with little to no online writing history and found they had a bit more anonymity, but the window is quickly closing. Claude sometimes guessed people based on their social circles, suggesting it was picking up shared stylistic traits. In one case, the model failed to name the correct author of a private Discord message but instead identified two of her close friends who had more public writing.

Repeated tests produced similar near-misses, with the model circling a small group of connected writers.

While AI cannot yet identify the average user from a single passage, it can already narrow down prolific writers — and that threshold is likely to drop as models improve.

Previously: Anthropic's New Model, Mythos, Is So Dangerous It Isn't Being Released to the Public

Image: Michael M. Santiago/Getty Images

Rallies and marches are scheduled today (Friday) across the country, as they were last Friday, in continued protest of the police killings of black people, and these include events in both San Francisco and Oakland. In SF, a rally is set to begin at 4 p.m. at Civic Center Plaza, and as KRON 4 reports, "Organizers say the protests will be peaceful." A separate rally will be happening at Frank Ogawa Plaza in Oakland starting around the same time.

Anonymous, or those in charge of this Anonymous-branded Twitter account, are calling this Day of Solidarity, and are encouraging peaceful protests.

Several days ago, word went out via a series of emails and posts in conservative media that Anonymous and/or Black Lives Matter was planning "Day of Rage" protests today. The Dallas County Sheriff's Department is said to be bracing for this, and the Defense Department even sent out a warning to its employees to avoid the DC rally location, which is outside the White House, "for your personal safety." But as Snopes points out, the email that went out with the locations in 37 cities and using the term "Day of Rage" are nearly identical to a message that circulated in August 2014, in the wake of the shooting of Michael Brown in Ferguson.

This is not to say that none of these protests will materialize today, but an organized "Day of Rage" is not what Anonymous itself is calling for. See tweets below, calling instead for #DayofSolidarity.

It should also be noted that an anonymous tipster called the SFPD last Thursday to warn of violence and anarchy in the streets during last Friday's march, and this threat failed to materialize. The evening ended with no outbreaks of vandalism or violence, and very few arrests. A subsequent, smaller group of marchers on Saturday were determined to get onto the freeway, however were thwarted by police in several attempts.

A very large protest last Thursday in Oakland, however, numbering in the thousands, succeeded in shutting down the 880 freeway for several hours.

Previously: Hundreds Of Black Lives Matter Protesters March Through Downtown SF, Attempt To Get On Freeway

Disgraced social media manager and avid Twitterer Matthew Keys was found guilty Wednesday in U.S. District Court in Sacramento of conspiracy in a case dating back to 2013 involving Anonymous and the L.A. Times website. According to chat logs presented by the prosecution, as reported by The Verge, Keys gave login information to the backend of the LA Times to members of the Anonymous hacktivist collective, instructing them to "fuck shit up." This was in response to, or in retaliation for, Keys' firing from Sacramento TV station KTXL/FOX 40, which is owned by the same parent company as the LA Times, The Tribune Company.

The actual hacking was fairly minor — as shown earlier on SFist, and as you can see below, someone went into a story on the front page of the website about a tax cut package in Congress and inserted "CHIPPY 1337," and according to Keys' defense attorney, the vandalism was cleaned up within an hour. Nonetheless, Keys was convicted on counts of conspiracy to cause damage to a protected computer, transmission of malicious code, and attempted transmission of malicious code, and could face up to 25 years in jail — though he's more likely to face less than five years, or simply probation, depending on the leniency of the judge in his sentencing come January.

Keys' case has been taken up by internet activists and foes of the Computer Fraud and Abuse Act as an example of inappropriate prosecution of a journalist, as Forbes reports, though calling Keys a journalist may be a stretch — he has mostly served as a social media manager for Thomson Reuters and KTXL, though he did write a 2012 story on a Reuters blog about Anonymous and the prosecution of a hacker named Sabu. Says David Segal, executive director of Demand Progress, "The Computer Fraud and Abuse Act is entirely out of sync with the way people use computers... [and] Today’s conviction of Matthew Keys is yet more evidence that this needs to be fixed."

Critics argue that the punishment prescribed by the CFAA is not commensurate with cases like this, in which the actual damage was very minimal. "With much bluster," Segal says, "the Department of Justice has pointed to the absurd statutory maximal penalty for somebody in Keys’s shoes: 25 years for enabling a harm that entailed changing the words on a website for all of an hour."

It does not seem, though, that there is much argument about the facts of the case and Keys' guilt — the arguments are just about what financial harm the hacking actually caused. As Vice notes, the Tribune Company claimed that the hacking knocked out the mobile version of the LA Times site for a full day, and that the incident caused a total of $929,977.00 in damages, which the defense said was ridiculous.

In any case, Keys was back on Twitter today retweeting all the tweets that have come to his defense, including one from Edward Snowden.

And Keys' response to the verdict was as follows:

All previous coverage of Matthew Keys on SFist.

Matthew Keys, most recently the deputy social media editor for Reuters, was fired today following last month's accusations that he had conspired with Anonymous hackers to gain access to Tribune Company computers and modify a news story on the L.A. Times website. After a long week of retweeting news coming out of Boston, Keys took to Twitter to announce he had been cut from the team:

Echoing his vow to fight hacking accusation, Keys says the Newspaper Guild of New York will be filing a grievance over his dismissal. After a flurry of media types on Twitter immediately connected the firing with the hacking case, Keys says that was not the reason for his dismissal:

Instead, Keys claims he is being fired for violating a written warning he received from Reuters after creating @PendingLarry a parody account of Google CEO Larry Page. Keys posted his "first and final" warning letter online, which states that the parody account violated Reuters' Code of Conduct.

Although Keys has been suspended without pay since the Department of Justice handed down their indictment last month, the former deputy social media editor kept working on his own during last week's tumultuous news cycle, relentlessly tweeting information — not all of it correct — coming out of Boston. His firing today was apparently unexpected and as he told Politico this morning, he assumes his former employers was "looking for an out."

"It’s my understanding that Reuters did not agree with some of the coverage I did on my own during the Boston Marathon events from last week," Keys told Politico. "And they have a specific set of reasons for the termination which I don’t agree with and the union that represents me does not agree with."

Late last week, in a The Awl documented some of Keys' Boston coverage in a post dissecting the recently created role of "social media editor" at various news organizations, which led with this back-and-forth between Keys and Buzzfeed editor Mike Hayes:

Update, 2:30 p.m.: In a response posted to his blog this afternoon, Keys lays out several reasons Reuters gave for his dismissal: his coverage of events in Boston last violated the October grievance regarding his behavior on social media and Reuters had a problem with Keys identifying himself as their employee in his Twitter bio while he was on suspension.

"That is a Catch 22 for me," he wrote, saying that removing the mention from his bio would have also violated the company's police and the earlier infraction. The company also disagreed with Keys' decision to tweet information from Boston Police scanner traffic, even after the department asked media outlets not to do so and called some of his reporting "reckless." Although his firing was apparently unrelated to the earlier hacking and conspiracy allegations, Keys claims, "[t]he suspension has been political from the start."

[Politico]
[TheAwl]

Matthew Keys, the Thomson Reuters employee accused of conspiring with members of the Anonymous hacker collective, has been suspended by the noted media company. Reuters reporters Joseph Menn and Dan Levine filed their own report about the story last night, confirming that Keys' workstation had been "dismantled and that his security pass had been deactivated."

Keys is accused of handing over login information for Tribune Company systems to members of Anonymous, who used the information to modify at least one news story on the L.A. Times website. Gawker tracked down a two-year-old screenshot posted on Reddit noting, it "looks like anonymous has gotten into the L.A. Times web site."

Under the screenname AESCracked, Keys spoke with members of Anonymous after the hack, calling it "nice" and explaining that he had "a hard drive full of Tribune crap." Keys had previously made connections to Anonymous during the same time period under the guise of covering the hacker group for a news story. Last year he shared chat logs of his interactions with seemingly high-level Anonymous members with Gawker and other news outlets, explaining that he had identified himself to the group as a journalist during those conversations. Members of Anonymous, on the other hand, apparently outed Keys' involvement in the L.A. Times hacking as early as two year's ago.

From Anonymous hacker Sabu, in March 2011:

As we noted on Thursday, Keys' Twitter feed is a mix of personal thoughts and curated news links on current topics — something that won him spots on a lot of "who to follow" lists. Late Thursday night, he acknowledged his own indictment with a retweet of @BreakingNews and a link to Politico's original story on the Department of Justice paperwork, followed by a personal note:

True to his Twitter persona, Keys was back at it this morning retweeting Reuters stories and commenting on some of the media show surrounding his indictment. Meanwhile, Gizmodo reports that people close with Keys felt he had been acting paranoid in the days leading up to the indictment, as if he knew something was about to collapse on him.

Keys apparently gained access to the Tribune Company's computer network while working for KTXL Fox 40 in Sacramento before moving on to KGO-TV in San Francisco and eventually Thomson Reuters in New York. Adding another wrinkle to the story, at least one person has come forward to accuse Keys of defamation and impersonating others online. In a comment on Gawker, one user claims Keys used "his tenuous grasp of early social networking to create shitty websites and Craigslist posts full of lies and material created to defame people he didn't like."

Previously: Reuters Reporter Accused Of Conspiring With Anonymous, Hacking L.A. Times

Matthew Keys, a deputy social media editor with Thomson Reuters, allegedly handed out login information for his former employer the Tribune Company, owner of the Chicago Tribune, the LA Times and other news outlets.

Keys had worked for Tribune Broadcasting as a web producer for Sacramento Fox affiliate KTXL Fox 40 before going freelance for a few months and eventually landing at San Francisco's KGO-TV, where he was told "not to tweet more than six times an hour." The login information Keys gave out to hackers from the activist group Anonymous was enough for them to access and make changes to a web version of a Los Angeles Times news feature. According to the press release from the Department of Justice, Keys may have even encouraged them to screw with the site. The arraignment doesn't say when the alleged changes hit the LA Times, but a commenter on another site noted the Los Angeles Times had been hacked on December 14th, 2010.

His personal bio states that his blog on "journalism, social media and current events" is followed by respected media outlets like the LA Times and NBC News. The Huffington Post even named him one of the 50 People in Media You Should Subscribe To On Facebook, and he was one of Time Magazine's 140 twitter must-follows.

Keys currently lives in New York, but he is charged in Sacramento with three counts of conspiring to damage protected computers. If convicted, he faces up to ten years in prison, three years probation and up to $750,000 in fines. It also sounds like he'll have to forfeit his laptop.

As of this afternoon, Keys had yet to acknowledge the accusations on Twitter. Scratch that, Keys retweeted the story from @BreakingNews:

Update, March 15th: Keys has been suspended by Reuters.

[DoJ]
[Politico]
[BusinessInsider]

Christopher Doyon, a 47-year-old from Mountain View allegedly associated with hacktivist groups Anonymous and the People's Liberation Front, was arrested by the FBI yesterday morning for allegedly attacking Santa Cruz County's computer servers in 2010. That hack-attack was a response to arrests of several demonstrators who were protesting the County's ban on outdoor sleeping. Doyon was considered a spokesperson for the protesters who teamed up with the PLF to shut down the County's computer systems. According to Fox News who originally reported the busts, Doyon was living without a home in San Francisco at the time of the arrest.

Two other alleged members of LulzSec - a splinter cell of the Anonymous group that has been getting a lot of bandwidth in the press lately - were also indicted yesterday: One Cody Kretsinger, 23 of Phoenix, who was charged with obtaining confidential information from Sony Entertainment's computer systems. And Joshua Covelli, 26 of Ohio, who was allegedly part of the Distributed Denial of Service attack on Santa Cruz County's network.

Hacker News speculates that the hackers were busted due to each hacktivist group's lack of focus and high-profile attacks. Although, If Doyon was hacking homeless, he probably left a nice trail of evidence on the PCs at the Main Branch Public Library.

[Chron]
[FoxNews]
[HackerNews]

The unfortunate souls who have to work today can not only enjoy some FOMO, along with commuting on a Sunday schedule, but they can also enjoy yet another BART protest. Fortunately, the protests have become more streamlined, for lack of a more exciting word, in recent weeks. Last week, there were no service disruptions.

Tonight's protest will take place at the usual time and location, 5 p.m. at Civic Center Station. As SF Examiner reports, Anonymous says they will continue to protest every Monday evening until BART meets its demands:

• disarm and retrain its police officers,


• fire its police chief and spokesman,


• publicly apologize for shutting down cell phone service, and;


• reopen the investigation into the killing of Charles Hill at Civic Center Station.

In other words, we can expect lots more of these Manic Monday opBART protests.

[SF Examiner]

That rosy-cheeked, kind of creepy Guy Fawkes masks you've been seeing plastered all over the news lately? Apparently they're a boon for massive Time Warner company, who owns the rights to the image thanks to the Warner Brothers' big screen adaptation of Alan Moore's V for Vendetta.

According to a New York Times report, Time Warner made roughly $28 billion in revenue last year and one New York costume shop owner told the paper of record that they sell over 100,000 of the Fawkes masks per year. That same costume shop sells the masks for $6.49 apiece on Amazon.

As for how the Anonymous group came to claim the pale, mustachioed look for themselves: The loose collective of hacktivists first latched on to the costume for purposes of real-world anonymity back in 2008, when Anonymous protested the Church of Scientology.

And speaking of remaining anonymous, local technical-creative cooperative Noisebridge, has created an ID card of sorts for (capital A) Anonymous protesters and others who show up to the now weekly demonstrations, identifying them as members of the press. The idea there is that anyone with a blog, twitter account, or anything else located at public http:// address could reasonably be considered a member of the press and will hopefully be treated as such if they've got some semi-official looking paperwork on them. Although that apparently didn't keep SFPD from detaining a few local reporters at last week's protest, so we wish them luck with that.

[NYT]
[NoiseBridge]