Three individuals in a conference room intently watch as a television plays a video of someone running on a treadmill, moving to a weight bench, then to a rowing machine. One of the viewers, Robin, feels a light tap on the shoulder as their attorney asks, “Robin, did you hear the question?” Robin turns to face Alex, opposing counsel, and asks, “You had people following me? How long has this been going on?”
Alex repeats the question: “Can you confirm that you are the individual seen in this footage?” Robin’s body stiffens, and a quiet “Yes, that is me” escapes their lips. Alex flips through the pages of a document and says, “In your previous deposition, three days after this footage was captured, you stated that your injuries prevented you from attending the gym…”
Time blurs under the bright fluorescent lights, and Robin is eventually told they are done for the day. They slowly stand, and just before leaving the room, turn to Alex and say, “I wonder how you would feel if people started following you around.”
When they get home, Robin navigates to Alex’s LinkedIn profile and notes every piece of identifying information they can find: face, full name, employer, professional email address, education, birthday, hometown. That should be enough.
Robin starts with breached data brokers and identifies a unique user handle tied to one of Alex’s online profiles. Searching that handle reveals breached data taken from a credit reporting agency, which contains a physical address in Alex’s hometown. This must be them. Robin goes to a popular people-search website, pays for a $25 monthly subscription, and searches that address. It is an apartment, and over 50 associated individuals appear, but Robin quickly identifies the correct profile from the listed names and birthdates.
Robin searches the social media profiles the report attributes to Alex and before long finds a public account with a matching profile picture. One monitor displays street-view imagery while the other scrolls through the profile’s timeline. Two months ago, Alex was tagged in a photo posted by their significant other showing them napping on a porch, and the paneling of that house looks familiar. That’s right. It’s the address on Oak Street.
Early the next morning, before sunrise, Alex starts to pull out of their driveway and notices a pair of headlights come on nearby. On the silent street, Alex begins their commute with a right turn, as does the vehicle behind them. At the next block, another right, and the other vehicle follows. The driver, Robin, sees Alex’s head frantically alternate between the road and the rear-view mirror, and smiles as their earlier question is answered.
This is an anonymized story focused on tools and methods well within reach of the average person. While open-source intelligence (OSINT) is used by investigators and law enforcement to combat bad actors, any OSINT resource can also be exploited by those same bad actors. After reading this paper, you will understand how bad actors obtain your personal data, how you can limit their impact, and how to keep future bad actors from getting it.
Why is my personal data available?
All data available for purchase falls into one of two categories: data we knowingly or unknowingly surrender to the public sphere, and data stolen from us or from the services we use. The first category covers public records and the content we share online. The second covers breached data.
On public records: while some jurisdictions actively protect personal data, the United States generally assumes that data held by the government is available through a public records request. The Freedom of Information Act (FOIA) established that any person has the right to request access to federal agency records. States modeled their own public records laws on FOIA, including the California Public Records Act, which likewise grants every person the right to inspect any public record. Both acts carve out exemptions for certain record types, but they often do not protect home addresses and other personal data from disclosure. On the contrary, jurisdictions such as Los Angeles County actively advertise the depth and scope of real property data available for purchase. These factors gave rise to commercial data brokers that harvest not only real property rolls but also utility records, voter registrations, phone numbers, and even social media profiles, all packaged and sold to anyone with a credit card.
Social media is unlikely to appear in government records, but data brokers often identify profiles using the wealth of data available from official sources. Adding your hometown, university, or occupation to an online bio makes it easy for friends and family to find your profiles, and just as easy for data brokers and bad actors. The cost of that convenience is privacy, and not only our own. In 2021, Senators Amy Klobuchar and Lisa Murkowski wrote to the Federal Trade Commission noting that people-search sites often include the names and addresses of family members, making it difficult or impossible for domestic violence victims to safely relocate with relatives. When evaluating your digital footprint, you have to account for your relatives and close associates as well as yourself.
Finally, data breaches are an area where we have little control beyond using strong, unique passwords. As of 2018, cybercrime was estimated to be a $1.5 trillion industry, with data trading accounting for $160 billion of that. With figures that high, it is clear why bad actors are so interested in our data. Once a platform’s vulnerability is found and its data harvested, the data can be sold on the dark web for fractions of a penny per account. After the sale, the buyer may keep it for personal use or spread it to the surface web, where commercial data brokers can harvest it. In the opening story, Robin used a paid database to find more information about Alex. Such tools are useful to individuals and security professionals assessing risk and building corrective plans, but any OSINT resource designed for good can be twisted to nefarious ends.
What should I do to protect myself?
At this point, it is normal to feel some anxiety about your privacy. The good news is that one change puts you back in control: don’t share personal data with anyone unless you absolutely have to. Deed your property to an anonymous trust, make your social media profiles private, and don’t reuse login credentials across platforms. These three small changes limit how far your data spreads.
Being privacy-oriented is a habit, and not always the easiest option. But if you take one action after reading this paper, block or remove non-essential cookies and trackers on the sites you visit. One of Meta’s recent ad campaigns pushed the idea that good ideas deserve to be found, and that the company can connect you with relevant businesses without sharing any identifying information. The problem with that claim is that research has shown 99.98% of Americans can be re-identified from their recorded demographic attributes. Read any company’s pledge to consumer privacy with that in mind, because the only people in a position to value your privacy are you and other consumers. For a sense of how much consumer privacy is valued, look at Amazon’s Ad Verification program, which tracks the ads you see across browsers and apps in exchange for $2 a month. Protecting your privacy means valuing it more than data brokers are willing to pay for it. Deeding your home to a trust and rejecting cookies are first steps toward making your data harder to package and sell.
How can I remove data available online?
The names, nature, and number of data brokers are always changing, but the methods for combating them are generally the same. In 2018, California passed the California Consumer Privacy Act (CCPA), giving consumers the right to know what personal data platforms collect, the right to delete it, and the right to opt out of its sale. In response, data brokers created ways for consumers to make these requests, some less burdensome than others. The CCPA and later laws in Nevada (2019), Virginia (2021), Colorado (2021), Utah (2022), and Connecticut (2022) have let consumers reclaim ownership of their data from brokers who are all too eager to sell it. At the time of writing, that means roughly 19% of the U.S. population can cite legislation when exercising their privacy rights. Some platforms have adopted a blanket approach to privacy, but it would be unwise to assume all data brokers will follow until most states have enacted privacy laws of their own. Until then, any privacy-minded person should avoid adding to the already large stockpile data brokers have collected by keeping their personal data exactly what it should be: personal.