We Are All Living in Bird Box: KOX, a Newsmax Host and the Data We Can't See

In the film Bird Box, the world is overrun by something nobody can describe, because anyone who looks at it is destroyed. The survivors live blindfolded. They walk through forests and paddle down rivers with their eyes covered, listening for danger they cannot see, and the film's quiet horror is that the threat is everywhere and invisible at the same time.

I thought about that film this week, watching a television host in New York learn, in real time, how visible he is to people he has never met.

A remark made for one audience, heard by another#

During a segment on immigration and sanctuary cities, Newsmax host Rob Finnerty told his viewers that when migrants from developing countries move to "blue sanctuary cities", "the cities then start to look more like Nairobi than New York City." None of the people interviewed in the segment were Kenyan. Nairobi was simply reached for as a shorthand for disorder, the way it so often is.

The segment was made for an American cable audience. Within hours it was in Nairobi.

Kenyans on X, the community that has been known for years as KOT (Kenyans on Twitter) and now increasingly as KOX, did what they are famous for. They flooded his replies and Newsmax's pages, they clipped the segment and annotated it, they explained Nairobi to him at length and with considerable humour. Profiles of his career appeared in Kenyan media within a day. And then, as these things increasingly do, it went further. A widely shared post published what it said was his personal phone number, with an instruction that every Kenyan reading this blog will understand perfectly:

"Alert! A certain Newsmax reporter has deeply disrespected us. Listen to the video. This is his handle. Phone number. Share widely, we must greet him." (Redactions mine.)

By Tuesday morning, 13 October, he had posted an apology "to the people of Nairobi, Kenya", saying he misspoke and was sorry to anyone he had offended. It has since been viewed more than two million times. Many Kenyans said it wasn't enough, and that an insult delivered on television should be retracted on television.

I have no interest in defending the remark. It was lazy, and it repeated a stereotype that costs this country real money in tourism, investment and dignity. But I study systems for a living, and as a computer scientist the part of this story that interests me most is not what he said. It is how quickly a stranger's phone number travelled across an ocean, and how few of the people sharing it stopped to ask how it was found, whether it was even his, or whether the same thing could happen to them.

It can. That is what this article is about.

The internet has no "local" anymore#

Social media researchers have a name for what happened to that broadcast: context collapse. Every message used to have an audience. A joke told in a bar, a sermon in a church, a segment on a cable channel. You calibrated what you said to who was listening. Networked media collapses all of those audiences into one. Anything recorded can be clipped, anything clipped can be shared, and anything shared can reach the one community it was never meant for, at the exact moment that community is paying attention.

The mechanics are simple. A clip is posted. A few accounts with large followings in a particular community share it. The platform's recommendation systems, which reward engagement and nothing else, notice that people are reacting strongly and show it to more people like them. Within an hour, a remark aimed at viewers in Ohio is trending in Nairobi, and the reaction is so large that it becomes a news story of its own, which brings in a third audience. Nobody planned this. It is just what the network does.

Kenyans know this better than most, because KOX has been on the other end of it before, and has often been right. In 2015, ahead of President Obama's visit, CNN described Kenya as a "hotbed of terror." The #SomeoneTellCNN campaign that followed was so sustained that a senior CNN executive flew to Nairobi to apologise. That is a remarkable thing: a country's online public changing the behaviour of a global newsroom through nothing more than collective, public argument.

But the playbook has evolved, and not only in good directions.

From hashtag to home address#

It helps to think of online pressure as a spectrum, because the moral line runs through the middle of it:

1. Public speech. Replies, quote posts, hashtags, satire. You argue with what someone said, in public, where they said it. This is legitimate, and often healthy.
2. Coordinated pressure. Mass tagging of an employer, sponsors and regulators. Still public, and aimed at an institution, but already amplified beyond any single voice.
3. Doxxing. Publishing someone's private information, such as a phone number, home address, family members or workplace details, so that a crowd can reach them outside the conversation.
4. Harassment. Thousands of calls and messages to that number. Threats. Contacting relatives.
5. Hacktivism. Attacks on systems for political ends: defacing websites, knocking services offline, leaking data.

Steps one and two engage with the argument. Steps three to five go around it, to the person. The moment a phone number is published, the crowd is no longer debating what he said; it is reaching into his private life. That is the line.

Kenyans have seen this escalation at home too. During the 2024 protests against the Finance Bill, the personal phone numbers of members of parliament circulated online, and many were flooded with calls and messages urging them to vote against it. Many people saw that as democratic pressure on elected representatives who had stopped listening, and the argument has real force. But the technique does not check whether its target is a lawmaker or a television host or a private citizen who said something foolish. Once a community learns that a phone number is a weapon, it is available for every grievance.

And hacktivism is not hypothetical here either. In July 2023, a group calling itself Anonymous Sudan claimed a wave of denial-of-service attacks that disrupted Kenya's eCitizen portal and other services, explicitly as a political statement. Hacktivism feels righteous to the people doing it, and like an outage to everyone else.

Doxxing isn't hacking. That's what makes it frightening#

Here is the part most people get wrong. When a phone number like that one appears online, the instinctive assumption is that someone hacked something. Usually, nobody did.

I don't know how that particular number was found, and I'm not going to speculate or retrace the steps. But I can tell you how this is normally done, because the methods are well documented and none of them require breaking into anything. The discipline is called open-source intelligence, or OSINT, and it is the art of assembling information that is already out there:

• Data brokers. In the United States especially, an entire industry collects public records, marketing data and purchase histories, links them to individuals, and sells "people search" profiles to anyone with a card. Phone numbers, past addresses and relatives are often a few dollars away.
• Breach data. Every large leak of a company's customer database is copied, traded and indexed. An email address from one breach links to a phone number in another, and to a password in a third.
• Things we published ourselves. An old business registration. A CV uploaded in 2014. A property listing. A wedding website. A charity race result. Each harmless alone.
• The mosaic effect. This is the key idea. Individually trivial facts, combined, become a map of a person's life. No single piece was secret. The aggregation is the attack.

That is why I keep thinking about Bird Box. We go through our digital lives blindfolded. We know, in a vague way, that there is something out there, but because we can't see it, we behave as if it isn't. And unlike the film, the blindfold does not protect us. Not looking at your exposure does not reduce it at all.

Before we laugh, let's look at ourselves#

It is easy to read this as a story about an American who got what was coming to him. As a researcher, I'd ask Kenyans to sit with a less comfortable question: how long would it take a determined stranger to do the same to you?

Consider a few things that are completely normal in Kenya:

• M-Pesa reveals names. Send a small amount to almost any Safaricom number and the confirmation message shows the registered name of its owner. It is a feature that prevents mistakes, and it is also a free lookup service that turns a phone number into a name.
• Caller ID apps crowdsource your identity. Apps like Truecaller build their directories partly from the contact lists their users upload. You may never have installed the app, and still be in it, saved under whatever name your mechanic gave you.
• WhatsApp groups are not private. A chama group, a church group, an estate group, an alumni group: hundreds of strangers can see your number, your profile photo and, often, your status updates. Screenshots travel.
• Photos carry metadata. Many phones embed the location where a picture was taken into the file itself. Post the original file, and you may post your home's coordinates with it.
• Our own leaks. Kenyan institutions have suffered breaches and leaks like institutions everywhere, and Kenyans' ID numbers, phone numbers and names already sit in more databases than anyone could list.

The same toolkit that found a phone number in Florida works just as well in Kitengela. The only difference is whether anyone is motivated to point it at you, and as this week showed, motivation can arrive within an hour, from the other side of the world, because of one sentence.

The mob is a blunt instrument#

There are three reasons a security researcher worries about crowd doxxing even when the target is unsympathetic.

It is often wrong. Numbers get recycled by telecoms. Records go stale. People share the same name. After the Boston Marathon bombing in 2013, online sleuths confidently identified a suspect who turned out to be an innocent student who was missing at the time, and his grieving family was harassed for it. A crowd cannot verify; it can only amplify. Whoever owns that number today, whether it is him, a former colleague or a stranger who inherited it, is the one whose phone rings at three in the morning.

It escalates beyond anyone's intent. No individual sharing that post meant to cause harm. Most meant to "greet" him, in the playful Kenyan sense. But a thousand playful greetings is a denial-of-service attack on a human being, and the crowd contains the occasional person who is not playing at all.

It undermines the argument. KOX had the stronger case. The remark was unfair, and the apology came because the public pressure was relentless and, mostly, sharp and funny. Doxxing hands the other side a better story: not "TV host insults a city" but "foreign mob harasses TV host." The phone number added nothing to the argument and gave away the moral high ground.

It is also worth knowing that it isn't consequence-free. Kenya's Computer Misuse and Cybercrimes Act of 2018 criminalises cyber harassment, and the Data Protection Act of 2019 regulates how personal data may be collected and shared. Platforms, for their part, generally prohibit posting private contact information. "Everyone was sharing it" has never been a strong defence.

Taking off the blindfold#

The good news is that, unlike the creatures in Bird Box, your exposure can be looked at directly, and looking at it makes you safer. A few practical steps I'd recommend to anyone, in roughly this order:

1. Search yourself the way a stranger would: your full name, your phone number, your email address, your usernames, and your face through a reverse image search. Note what comes up.
2. Check your breaches at a service such as Have I Been Pwned, and change any password that appears there. Then stop reusing passwords; a password manager makes that painless.
3. Turn on two-factor authentication, and prefer an authenticator app over SMS codes wherever you can, because SIM-swap fraud turns your phone number into a key to everything else.
4. Separate your public and private numbers. If you have any public role, as a business owner, creator or commentator, give the world a second line and keep your personal number for people you know.
5. Unlist yourself where you can. Caller ID services and people-search sites generally have removal or unlisting processes; use them.
6. Strip location data from photos before you post them, and review which apps can see your location, contacts and photos at all.
7. Audit your groups. Leave the WhatsApp groups you no longer need, and change your profile photo and "about" visibility to contacts only.
8. Know your rights. Under the Data Protection Act, you can ask organisations what they hold about you and complain to the Office of the Data Protection Commissioner when your data is mishandled.

And the most important step is the one we take for other people: don't share someone's private information, even when you're angry, and especially when you're angry. Argue with what they said, as loudly and as wittily as you like. That is what KOX does best, and it works.

What this week actually showed#

Strip away the noise and the story is a lesson in how connected we are. A sentence spoken in a New York studio reached Nairobi within hours. A community of millions responded within the hour. A phone number crossed the Atlantic faster than any letter of complaint ever could. And a man who, a week ago, had probably never thought much about Kenya now knows exactly how many Kenyans there are on X.

That connectivity is power. It forced an apology, just as it once forced CNN to send an executive to Nairobi. But power that can find anyone's phone number can find yours too, and the blindfold that lets us ignore that fact is not protection.

Take it off. Look at what is out there about you. Then use the power of the crowd the way it works best: on the argument, in public, and never at someone's front door.