I probably should have written this post a few months ago, but a friend reminded me that it is still relevant, even though many of us filed our taxes last week. As the number of federal employees drops, the time to get online with various agencies makes more sense. And for those of you that have so far resisted the effort to do this — and of course, it is an effort, even for the most technical and computer literate among us — now is the time to get online with the feds. If you have tried to call the IRS for example, or visit a local Social Security Administration (SSA) office (those that are still staffed), you will have to have a tremendous dose of patience.

I should state that getting online with the US government is not quite what it could be, and for that we should look to Estonia where they have been doing this really well for a number of years. The initial experience in getting on board was also somewhat daunting, but now every federal agency there has some form of online access using a single system.

Anyway, back home we have two different central authentication service providers, because why not? The two are ID.me and Login.gov. Not all agencies use both — such as the IRS, which only uses ID.me. But if you pay your taxes online through the EFTPS.gov service, and want to access your account with the SSA, you can authenticate with either one. The two providers have somewhat different processes to get your credentials verified and your account setup.

ID.me has had a lot of growing pains when it was first introduced several years ago. (I wrote about this for Avast’s blog here.) I would not recommend using ID.me if you can use Login.gov as a way into your accounts.

One additional caveat about the IRS. Every January you should be using your online account to request a filing PIN. This prevents anyone else from filing a return with your social and name. Make sure to put this PIN someplace where you will remember it when you do file several months later. you need to request a new PIN each year.

Still with me?

Once you sign up and prove who you are to the service(s) — and the effort isn’t trivial and can be frustrating — you can then create an online account with whatever federal (and in some limited circumstances, state and local) agencies you want to conduct your affairs with that supports the provider. And even if you aren’t old enough to start receiving SSA benefits, you should still have an account with them just to check and make sure your deposits over the years have been properly recorded.

Okay, one final caveat about setting up your accounts. You should protect your account with an additional authentication factor, and both Login.gov and ID.me offer numerous options. The one that I use is a USB hardware key (Google sells its Titan keys shown above, but there are other vendors if you would rather deal with someone else). If you go this route, you should buy at least two keys, and put them in different places (such as office and home). You and your spouse can share the same key if that works for you. After you login to either service, you are asked to insert the key in your computer or phone (or use its NFC radio) and press the blinking icon on the key to finish the login process. One authentication method you should NOT choose is to send a code via SMS to your phone.

Once you get a hardware key, you should augment your logins with it wherever you can. Google, Facebook, your bank, your insurance company, etc. Not all places that you’d like to use it support these keys, which is sad and frustrating. Some banks only support two different keys, which is annoying.

I understand that getting this all setup will take time, and working through the various user interfaces will try your patience. But once this is done, you can interact with the feds digitally, which is a Good Thing. And maybe someday we will approach the digital density that they have in Estonia.

(revised 4/25/25)

A few weeks’ back, I wrote about a friend of mine that I called Jane who had suffered from a phishing attack that led towards her losing more than $30,000 in a pig butchering scheme. She called me last week and stopped by to show me that thanks to her homeowners’ insurance policy, she was able to be reimbursed for $25,000 in losses. This is because of an endorsement that included personal cyber insurance. This is the first time that I have ever heard of such coverage, so naturally I wanted to take a deeper dive.

Probably the best starting point is this 2023 Nerdwallet blog, which also helpfully links to the various insurers. It shows you the numerous perils that could be covered by any policy and makes a point that this insurance can’t cover things that happened before the policy is in force. Another good source is this 2023 blog in Forbes. If scroll down past the come-on links, you will see the perils listed and some other insurers mentioned.

This complexity is both good and bad for consumers who are trying to figure out whether to purchase any cyber insurance. It is good because the insurers recognize that cyber is not just a category like insuring a fur coat, or some other physical item. If your washing machine springs a leak and you have coverage for water damage — something that happened to me a few years ago — it is nice to be insured and be reimbursed. Whether you get the level of reimbursement that will enable you to rip out your floors, replace it with something of approximate value, and get your expenses of having to move your stuff and live in a hotel for a couple of weeks is up to the insurer. And whether your claim will eventually trigger your insurer to drop you, and place you on a block list for the next five years is another story. But you can still purchase coverage and the coverage is — for the most part– well defined.

But cyber insurance is not well defined, because of all these various categories of perils can spill over. If your computer is infected with malware and the attackers ultimately get access to your bank accounts, how do you prove that causality to the satisfaction of the insurer? What happens if you are faced with a demand to pay a ransom to get access to your data? Or if you think you are sending funds to help a family member or co-worker in distress that turns out to be a criminal? Many of the problems happen at that hairy intersection between technology and human error.

Before you go any further down this path, I want to take a moment and describe an entirely different approach. What if the financial vendors took a more pro-active role in stopping cyber fraud? It is happening, albeit slowly and under certain specific situations.

One such example is Coinbase, who wrote about what they are doing in a February blog here. The post presents a series of situations where social engineering played a role in a particular fraudulent scheme. “Coinbase will never make an unsolicited phone call to a customer. Anyone who calls you indicating that they are from Coinbase and wants you to move assets is a scammer. Hang up the phone!” There are other recommendations that span the technical spectrum such as using better authentication factors and rotating API keys. As you may or may not know, Coinbase is deeply involved in crypto transactions, so this is a natural fit.

Contrast this with Bank of America, just to choose someone at random. If you know where to look, you can review five red flags used by scammers, including being contacted by someone unexpectedly, being pressured to act immediately, pay in an unusual way or asked for personal information. Unfortunately, they only allow you to specific two hardware security keys, which seems to go against best security practices.

And this is why we are in the state of affairs with scammers today. Incomplete, imperfect solutions have enabled the scammers to build multi-million dollar scam factories that prey on us all the time. Just this past weekend, both my wife and I got text reminders that the balance on our EZ Pass accounts was low. There were only two problems: neither of us use or even live near anyplace we can use them, and both originated from a French phone number. Sacre bleu! This is an attack which has been around for some time but recently resurfaced.

If you have decided to purchase this type of insurance for you or your family, there are two basic paths. First is to see if you can add a cyber “endorsement” to your existing homeowners or renters policy. If this is possible, decide how much coverage you need. Many insurers have these programs, and here it pays to read the fine print and understand when coverage will kick in and when it won’t:

• • • AIG
    • ​Acuity
    • State Farm 
    • Mercury Insurance​ ​
    • PURE​
    • Integrity Insurance​

If you have an insurer that doesn’t have this capability, you can go with one of two specialist cyber policies. Nerdwallet summarizes these offerings by NFP (they call it Digital Shield) or Blink, a division of Chubb. USAA (my current home insurer) works with Blink for example and offered me an add-on policy for $19/month. Blink doesn’t cover fraud from malicious family members or cyberbullying by employers, a widespread cyber-attack and some other situations. From my reading of the NFP’s Digital Shield webpage, it seems like these situations are covered by their policies. They told me, “We provide coverage under two different plan options, DigitalShield Advantage and DigitalShield Advantage Plus. Because it is a policy designed specifically to cover cyber risks, it may offer more flexibility and broader coverage than the options afforded by some of the “add-on” cyber options offered by home insurers. We offer coverage limits starting at $25,000 for $64 a year, with options up to $250,000 and also additional home office coverage.” You can price these out on this webpage.

The bottom line? While my friend was able to benefit from her cyber policy, you might not. Visesh Gosrani, who is a UK-based cyber insurance expert, told me “The limits these policies come with are normally going to be disappointing. The reason these policies are being bundled is that in the future homeowners are expected to realize that cyber insurance is important and more open to increasing their coverage if they have already had the policy. The short-term risk is that they end up being disappointed by the policy that they had for free or very little cost.”

All this talk about Occupy Greenland this week got me reading this 2013 report from the US Naval Institute about the harsh realities about shipping goods across the Arctic seas. The TL;DR: shipping loads of containers across the top of the world, while shorter in distance than sending it through Panama and Suez — isn’t necessarily cheaper when you do the basic math. Here is why:

First off, the problem is that the typical container ships are huge, and they come that way for a simple reason: the more they carry, the cheaper the cost per container to send it from one port to another. The smaller container ships that could be run in the Arctic are because the ice breakers aren’t as wide. There are also shallower channels that restrict the size of these ships when compared to the global routes. When you add all these factors up, a container going through the Arctic will cost more than twice as much as sending it “the long way around.”

Second, the Arctic isn’t ice-free year round. In actuality, even with global warming, routes are ice-free for only a third of the year, and sometimes less. On top of this, weather conditions can change quickly. Global shipping depends on tight schedules. These also involve making several stops along the way to supply just-in-time manufacturing systems, and spreading the costs of shipping across the route. A typical 40-some-day trip from the eastern US to Asia route is shared by a series of six ships making regular stops. This is called the network effect. Going across the Arctic would not have as many intermediate stops.

But what about other kinds of shipping, such as minerals or energy products that come from Arctic sources? It is possible, but still depends on all sorts of infrastructure to extract and load this material — which does not exist and probably won’t for quite some time.

Finally, with or without Greenland, to send stuff across the Arctic isn’t the same as crossing the Pacific or Atlantic oceans because the connectivity is poor. A typical route has to transit a series of narrow straits that is currently claimed by Russia, with high fees to move through these straits.

“Arctic routes do not now offer an attractive alternative to the more traditional maritime avenues, and are highly unlikely to do so in the future,” the report concludes. And while things have changed somewhat since this report was written, the factors cited above are still valid.

I have split my years living part of the time in suburbs and part in urban areas. This is not counting two times that I lived in the LA area, which I don’t quite know how to quantify. I have learned that I like living in what urbanist researchers (as they are called) classify as a “15-minute neighborhood” — meaning that you can walk or bike to many of the things you need for your daily life within that time frame, which works out to about a mile or so walk and perhaps a three mile bike ride. I also define my neighborhood in St. Louis as walk-to-Whole Foods and walk-to-hospital, somewhat tongue-in-cheek.

Why is this important? Several reasons. First, I don’t like being in a car. On my last residency in LA, I had a 35 mile commute, which could take anywhere from 40 minutes to hours, depending on traffic and natural accidents. At my wife’s suggestion, I turned that commute into a 27 mile car ride and got on my bike for the last (or first) leg. While that lengthened the commute, it got me to ride each day. Now my commute is going from one bedroom (the one I sleep in) to another (that I work in). Some weeks go by where I don’t even use the car.

Second, I like being able to walk to many city services, even apart from WF and the doctors. When the weather is better, I bike in Forest Park, which is about half a mile away and is a real joy for other reasons besides its road and path network.

This research paper, which came out last summer, called “A universal framework for inclusive 15-minute cities,” talks about ways to quantify things across cities and takes a deep dive into specifics. It comes with an interactive map of the world’s urban areas that I could spend a lot of time exploring. The cities are mostly red (if you live here in the States) or mostly blue (if you live in Europe and a few other places). The colors aren’t an indication of political bent but how close to that 15-minute ideal most of the neighborhoods that make up the city are. Here is a screencap of the Long Island neighborhood that I spent many years living in: the area shown includes both my home and office locations, and for the most part is a typical suburban slice.

The cells (which in this view are the walkable area from a center point) are mostly red in that area. Many commuters who worked in the city would take issue with the scores in this part of Long Island, which has one of the fastest travel times into Manhattan, and in my case, I could walk to the train within 15 or so minutes.

The paper brings up an important issue: cities to be useful and equitable have to be inclusive and have services spread across their footprints. Most don’t come close to this ideal. For the 15 minute figure to apply, you need density high enough where people don’t have to drive. The academics write, “the very notion of the 15-minute city can not be a one-size-fits-all solution and is not a viable option in areas with a too-low density and a pronounced sprawl.”

Ray Delahanty makes this point in his latest video where he focuses on Hoboken, New Jersey. (You should subscribe to his videos, where he talks about other urban transportation planning issues. They have a nice mix of entertaining travelogue and acerbic wit.)

Maybe what we need aren’t just more 15-minute neighborhoods, but better distribution of city services.

Last month, I suggested that it is time to remove ourselves from Twitter. There are several ways to do this. You’ll see my process and you can make your own decisions. TL:DR is:

• I stopped posting more than a year ago, but still kept my account to protect my brand as a placeholder.
• I downloaded an archive of my tweets in multiple ways, and will tell you why this is necessary.
• I then deleted all my tweets, using the Windows software from Cyd.social.
• I also deleted the other digital effluvia of my account, including retweets, likes and follows).

Before we go down this journey, I would urge you all to read how to backup all of your social data, a blog that I wrote many years ago and have tried to keep current. If you haven’t ever done this, now is the time to create and download these archives. This should be a part of your regular backup processes of your data.

Backing up your social network data

That post will direct you to a particular link where you can prepare and then download an archive of each of your accounts. For Twitter, it might take a day or two to gather it together, but Twitter will send you an email when it is ready, and then you have a few days to download it. The others have somewhat different processes and schedules. You can pick and choose various options and data types to include in your archive: for example Google has dozens of services that may or may not be meaningful to save periodically.

But, and this is important: the archive of your tweets depends on having a working Twitter account. There is a page of HTML that will bring up a summary of your archive, but the tweets and follows and so forth have to exist online. It is a somewhat half-solution. I had a small hiccup with my archive that I will get to in a moment.

A better solution is to use one of the dedicated archive/deletion tools, and as I said, I ran Cyd.social, which logs into your Twitter account and then creates a complete offline archive. The hiccup was that Cyd didn’t like the very long file name that Twitter created, so I renamed it and that passed muster. Cyd uses this archive as a starting point to seek out and delete your content history.

There are two versions, as you can see from the screenshot: the free one will archive and delete all of your tweets. The paid version (which you can purchase an annual subscription initially for $36) will also allow you to be more selective and keep some of your tweets, and also delete other aspects of your account, such as followers, likes, and DMs.

I upgraded to the premium version so I could delete everything. I liked the design of the software, which tells you in advance what it is about to do to your account. Because Twitter has put in place rate limits to prevent these mass deletion operations, Cyd has to work around them and sometimes pauses during its housekeeping to foil these limitations.

One content type you might notice is not covered by Cyd is list management. I have quite a few lists, and ideally would like to convert them to followers on LinkedIn before I delete them, but I haven’t found a tool to do that.

Another thing that I noticed browsing my archive is how few of my words of wisdom were retweeted or liked. Almost all of them had no engagement whatsoever. You would think with all the years of using Twitter and various analysis tools I would have noticed this before now. Sigh.

I came across a free analysis tool from Cleve.AI that does summarize my LinkedIn activity. You can see an excerpt from my report below, which has a nice summary of my words of wisdom, shown below.

Best wishes and happy new year to you!

Samuel Stroud, the British blogger behind GiraffeSocial has posted a column taking a closer look at how TikTok’s algorithm works — at least how he thinks it works. But that isn’t the point of the post for you, dear reader: he has some good advice on how to improve your own social media content, regardless of where it lands, and how it is constructed.

Before I get to his suggestions, I should first turn to why I used the word outrage in my hed. This is because a new Tulane University study shows that people are more likely to interact with online content that challenges their views, rather than agrees with them. In other words, they are driven by outrage. This is especially true when it comes to political engagement, which often stems from anger, and fuels a vicious cycle. I realize that this isn’t news to many of you. But do keep this in mind as you read through some of Stroud’s suggestions.

You might still be using Twitter, for all I know, and are about to witness yet another trolling of the service by turning all user blocks into mutes, which is Yet Another Reason I (continue to) steer clear of the thing. That, and its troller-in-chief. So now is a good time to review your social strategy and make sure all your content creators or social managers are up on the latest research.

Stroud points out several factors to keep track of:

• Likes, shares and comments: the more engagement from others, the higher a post is promoted. And this also means you should respond to the comments too.
• Watch time: Videos that are watched all the way through get boosted
• New followers: posts that generates new followers signing up also get boosted
• More meta is betta: Captions, keywords, hashtags, custom thumbnails — all of these help increase engagement, which means paying attention to these “housekeeping” matters almost as much as the actual content itself.
• Your history matters: if you have had previous interactions with this creator, type of content, or other trackable habits

Now, most of this is common sense, and perhaps something you already knew if you have been using any social media platform anytime over the last couple of decades. But it still is nice to have it all packaged neatly in one place.

But here is the thing. The trick with social media success is being able to balance your verisimilitude with your outrage. It is a delicate balance, particularly if you are trying to promote your business and your brand. And if you are trying to communicate some solid info, and not just fuel the outrage fires, then what Stroud mentions should become second nature to your posting strategy.