Hey. This is Jason Edison from Intel techniques,
and you are listening to, firewalls don't stop
dragons.
Hello, everybody. Welcome back to firewalls don't stop
dragons. I'm your host Carrie Parker. Today we
have episode 386
for 07/22/2024.
And, man, do we have an amazing interview
for you today? I have been looking forward
to 1 for a long time.
There's been some, honestly, There's been some great
interviews this year if I say so myself.
But this is this a really fun 1.
Jason was an amazing
interview guest. And the topic matter I think
was just fascinating.
We're going to talk about Open source intelligence
or os
today.
Jason is the perfect person to talk to
you about this because he works, this from
both sides.
His day job working
for basically law enforcement
is finding people using open source intelligence and
kinda his night job or off job is
helping people to not get found by stalker
and
abusive of spouses or just people who want
to up their privacy game. So he's just
an absolutely perfect person to talk to you
about this subject.
And we're gonna talk about some things that
I bet most of you are not that
familiar with. And we'll be surprised to find
out
how much information about you is, out there,
and is readily available to anybody who knows
how to look for it. So the interview
was a little bit long so I'm gonna
keep the preview very short Just real quick,
we talked about a few terms, but I
wanna throw out real quick. We talk about
Fo, and that's F0IA
or Freedom of Information Act.
That is a law that allows people to
request information from their government
in the spirit of transparency
which I think is a noble goal, but
it turns out that
you can actually request information just on other
people that might have public records,
And most of these
agencies will gladly turn that over. He also
mentions in kind of the same breath, A
think called a Pd or a public disclosure
request.
That is,
along the same lines as a 4 year
request, I guess, different places called different things.
And finally, we talk about docs. Thing and
we will explain what that term means, but
it comes from the term documents
and basically getting the information about somebody public
documents on people So that's really all I
need to set this up. Let's get right
to my interview with Jason Ep.
Jess Edison is a 25 year veteran for
a major Us police department where he serves
as the technical lead for the agency's criminal
intelligence and cyber crime sections. Prior to this,
you ran undercover an electronic surveillance operations for
long term organized crime
investigations, And last but certainly not least, Jason
runs the Open source intelligence, privacy and security
training programs
at intel techniques dot com. Welcome to the
show, Jason. Hey, Carrie. How's is it going?
I'm so looking forward to this... I've been
following you guys for a while.
You guys literally wrote the book on privacy.
Michael Ba allen and yourself. I I... I'm
not sure what how you that up, but
you guys have had some great tools and
some great articles and
I've been a following that for a long
time. So I'm really, really psyche to get
you on the show. And I've been wanting
to do a show focused on open source
intelligence.
And I can't think of a better person
to do that with. So thank you for
being here. So why don't you tell start,
you know, stop a little bit more about
your background, Tell us? You know, what sorts
of things you do for the police department?
And I'm very curious to know what it's
like to run undercover electronic surveillance? What is
that... What does that work and entail exactly?
Sure. And I always like to start off
by giving a little bit of a background.
It is weird for those of us in
the privacy industry to talk about ourselves publicly.
But
on the intelligence side, we always say information
does not become intelligence until you have context
for it. Right? And so it's important that
when people are listening to my 2 cents
worth, on some of the topics we're gonna
cover today that they understand where I come
from because that's going to bring into play
my own perspectives, maybe my own biases, those
different things. So My background is primarily in
law enforcement in the Us. I started in
the mid nineties and have worked everything. From
being a patrol officer to street crimes like,
doing undercover street buys.
In the early 2 thousands, I... Worked into
a task force position with the Fbi and
worked organized crime for about 7 years, primarily
doing field surveillance, electronic surveillance under undercover work,
long term undercover cases.
And then 20 10, I moved to our
intelligence unit and have been doing intelligence in
cyber crime
investigations ever since.
And then on the side, my second career,
I work for Michael Biz
at intel techniques,
teaching bull offensive and defensive cyber. So basically,
Open source intelligence, so we teach a lot
of 3 letter agencies, private sector intelligence teams,
all sorts of folks how to gather
information off of the Internet effectively.
And then we also go out and do
a lot of cyber training. So we I
take what I've learned from investigating,
cyber crimes and in trading cyber crime groups,
and we go out and do keynote notes
and Do kind of a version of what
you do with this podcast of trying to
spread awareness.
I've brought this up a couple times, but
I really wanna get... Give this from a
pro. What is Os? How do you define
open source intelligence?
What does that turn mean And what are
maybe... And what are to kinda bring it
home, what are some common sources
of Os and and how do you access
them?
Sure.
So open source intelligence is just a fancy
way of saying being good at searching on
the Internet. In the and technically, it's even
more than just searching on the Internet. The
origins of Os or open source intelligence was,
like, collecting newspaper articles going to the library
and pulling up micro fees. You know? It's
basically being good at research. But in the
modern age,
95 percent of that research is going to
be on the Internet because we can get
to so much
information so quickly.
So that is sort of the textbook version
of what it is. What I always like
to add in there because I think there's
a pretty big spectrum.
Of, I guess, quality of open source intelligence
work is
you... If you're going to do this as
a
profession and not just a hobby
You need to also build up basic intelligence
skills, which is things like gaining that context
for what you find, fact checking.
Sourcing.
And basically being accountable for the research you
do. And that's 1 of the big differences
See these days is there's a lot of
people doing
online research open source intelligence,
but
I
professionals, we should all be checking our work,
showing our work and being accountable for our
work. So I was like to add in
that extra east because sometimes when people come
in
and go through our training,
you know, I can I can teach them
all the technical skills pretty easy, piece But
sometimes the more important things are procedural,
ethics,
and all of those other things that sometimes
we forget about? Right? It it all falls
under that with great power comes great responsibility.
And it sounds a little like journalism honestly.
Yes. Yeah. And we we train a fair
number of large,
yeah, news agencies and journalists and attorneys. Like,
we have a pretty diverse range of people
that we train, our bread and butter are
definitely in, like, government,
military,
intelligence teams at Fortune 500 companies, all of
that. But
really os is something that could be used
in any field. Like, literally, I ran my
2 kids through my classes
just to help them at being better at
doing things like researching their papers that the
right oh tool.
I and I got I got a lot
of rolls when I did that, and I
think mostly what my daughter got out of
it was figuring out how to writ music
and things off of the Internet, But it
was still
it was still kinda fun to go through
it with them. Yeah. And I I'd just...
You know,
I can't tell you how many times when
I tell people, like, well, you know, when
do Google searches. You can do things like
minus in front of words to ignore those
and put quotes around things that have spaces
in them or if you wanna make sure
it's they exactly the way you type it.
And there there's a lot of simple things
like that. People are like, oh, wow, really?
You know, there's there's a lot there's a
lot of kinda hidden features even it just
a straight up Google slash, you know, duck
search that a lot of people I don't
think Understand. But, yeah. This is this is
always obviously way beyond it. I'm just making
the point that there's a lot of things
that that are
that are available to people that that they
don't even understand it there. So so what
what company are you talking about? When you
go searching, you... I I assume you're doing
more than just a Google search. So what
other...
Types of sites good... I mean, if you've
got a
on your website, You've got, like, multiple dozen
links to search sites. So what other places
do you search looking for people info.
Yeah. You know, surprisingly or maybe not surprisingly.
Google is super effective. So there's a fair
number of operations and investigations where I can
find everything I need just using a browser
in Google. And that actually is my preference
because, you know, again, at the end of
the day, I have to be accountable for
my research, and a lot of my work
ends up in court Right? Mh So when
I have to testify to something, it's actually
real nice if I get asked, like, hey,
detective edison.
What secret spy tools did you use like
this, and I can look at the jury
and say, well, I use this secret spy
tool called Google? You might be familiar with
it. And so as much as possible, it's
actually nice to kinda stay in the shallow
end of the pool and use
tools that we can show are completely publicly
available.
Now,
obviously, sometimes we have to go beyond the
scope of Google
to broaden our results
and, you know, it really depends on the
engagement we're doing. But if doing a homicide
or we're doing a domestic terrorism case or
something like that. We're gonna kick over every
stone. Right? Like, we're we're not gonna stop
20 minutes in. We're I I think my
longest case was about 3 and a half
years.
And for that, we want those depth of
resources.
And as you mentioned on our site until
techniques are com. We actually have a public
facing dashboard and our our tools tab, which
everyone... We built that for everyone who goes
through our training, but anyone could use it.
Right? Like, let's say I wanted to check
my own
exposure on the Internet. You could go on
there. And put in your email address, your
phone number and those sorts of things,
and basically hunt yourself, research yourself
And not only will that give you an
idea of the types of tools that people
coming after you are using?
But it shows you your online exposures, which
then you could use to do what we
call a privacy cleanup.
So I would encourage everyone. These are free
publicly available. Their open source. Our source code
is right on the page.
We do not collect anything. This is just
there as a free resource for the people
who do our training programs, but we've made
it available to everyone. So no strings attached.
If you wanna know what Os is about
and try your hand at it, you could
just hop onto our dashboard and play around.
I will add this warning though.
Anytime you do what we call a self
assessment, that is checking your own
exposure.
We don't do that on, like, our work.
Computer. We don't do that on a public
computer. We would wanna do that on our
personal private computer because I don't want my
employer, and in my case my employer's the
government. So anything I do in my government
equipment is subject to Fo. Right? Mh. So
if you're gonna hunt your vulnerabilities,
be smart about it. Do it on your
private computer. And then what I do is
I just have a little privacy journal where
I go through and start taking notes by
hand. Hey. This site has my phone number.
This site has my date of birth, and
then I do the same for my kids.
Wow, so,
I've often heard the term do, and I
I think I could probably define that, but
I wanna I wanna hear you define that...
It sounds like what you're basically recommended it
is you try to docs yourself. To see
what's out there. Let's talk about that term
and and and if that's what you meant.
Yeah. So the do is basically a loaded
term. It is basically
using open source intelligence to do harm. So
you're not exactly docks yourself. But what what
you are doing is you're
attacking yourself from the position of someone who
is a cyber criminal or a doctor. So
what do, how that usually happens is,
me and a bunch of other kinda idiots
on the Internet, see someone, like a public
figure or you know, a lot of times
the do has to do with what I
call the Ism, racism,
sexism. There's almost always some sort of bias
involved. And so,
you know, I'm on the Internet with my
group of idiots and we're like, hey,
this person dared to say this thing or
this person is evil. We we should get
them.
And then we basically,
like lord of the flies.
Pile on, dig through their life cyber stock
them, and then we post all the personal
stuff online to make them fearful or uncomfortable.
So that is the key component. It is
done with the intent to create fear. It
is done to harass.
Right? Mh. And I I think sometimes these
things are cloaked in this idea of oh,
It's the great good because they're evil, so
we should out them. But man, that is
a dangerous road to go on where we're
standing judgment of other people often and without
all the details. And sometimes it's just flat
malicious. Right?
Both Michael, my partner, Michael and I had
a bunch of people on 4 chan come
after as several years ago and decide, we're
gonna docs because they're teaching people how to
investigate us. And, like, literally, they were calling
in social engineering our employers. They were you
know, doing everything short of digging through our
trash.
Now, my partner, Michael is pretty much the
invisible man, so they had 0 luck there
for Like, their their skills
were not up to par with their
kind of their narrative around the whole thing,
so they weren't really able to take that
very. Far, but there are definitely
a lot of people who fall victim to
detox and we're lot of damages done. A
lot of them are far on the privacy
side of our business where we do a
lot of cleanup ups or move people. Like,
literally, people getting cyber stocked so badly, we
have to move them to a different home.
We see a lot of this boxing as
part of cyber harassment and
things like ex. Right? If I can go
in and dig out your personal photos, then
I can start an ex scheme to you.
We see that a lot both on our...
For high profile targets
and clients, but also just on everyday people.
I see it in my day job too
as a detective. Ex is a big deal.
You'd already basically, I mentioned, You're you're kinda
of basically playing,
like, often offense during the day in defense
at night kind of thing.
You're you're doing both sides of this thing.
So
how how does each 1 of those inform
the other?
And and I'll go ahead and bring up
the question you kind of alluded allude to,
you know, someone who works for the government
in intelligence,
and who is also a privacy you have
to get? You know, what are what are
your thoughts on master surveillance? What do... How
how do you do both? And how do
they... How do how do they affect each
other from you play both sides.
Yeah. And I I think the short answer
is just like anything else, having experience on
both the offensive... When and defensive sides is
huge. Right? Because you can anticipate a tax.
You know what sort of, a threat model
you are in and what sort of attack
surface you have because you've been the attacker
before. Right? And folks who work in the
info sec field, folks who work in military,
anything where we do things, like red teaming
where Red teaming is basically where you and
I works together, and we attack each other,
so we get used to defending against the
attacks. Right? Mh. That's like a real simple
example. That the whole idea of a red
team is attack ourselves so that we learn
both sides of that equation and can test
our defenses. So there's definite advantages there.
1 training I went to years ago, I
I was going through a boot cam to
do my certified ethical hacker
certification. And
about halfway through this class. I'm looking around
the room for I am the only non
engineer in the room. Like, there's 30 people
from Info sec, and I I just remember
thinking I am by far the person in
room. Like, these were super smart experience people.
And I... Still so All beat myself up
of like, oh, my gosh. And then... Oh,
By the last day, I had a realization.
Everyone in that room had superior technical
experience and skills. But it became clear because
all the water cooler talking and all the
discussions of
anytime cyber crime came up, even though it
wasn't...
Information security class and about hacking,
no 1 else in the room had ever
had any experience working with, exposure to crime,
like criminals Mh. Like, people that had their
cars proud but nobody had spent time with
criminals. Nobody had infiltrated criminal work. And what
I have the sudden realization was that...
My experience on the investigative side was a
huge benefit to me on the defensive side
because I understand the culture of organized crime.
I understand the culture
of the enemy,
and that is huge
because in in intelligence, we call that cultural
intelligence, organized And I've really come to over
the years,
appreciate how that is a very very important
thing
is,
understanding the adversary. What are their goals? What
are their methods? What are their tendencies? Because
1 of the things we use most in
intelligence
is
people are generally predictable because we tend to
do things and patterns. But if you don't
understand someone's culture,
1, you're not going to be able to
see those patterns into, you're not going to
understand what they mean.
And then as far as government master surveillance,
So that's real interesting for me because I
used to literally
do electronics surveillance, like putting out cameras, putting
hidden you know, recording devices on undercover
inform, things like that.
And now I also work on the private
sector quite a bit for, doing privacy, and
I really care about privacy for myself.
And so this could be a 5 hour
conversation about this. But I will just tell
you having work both sides.
I am not for me and my family
worried about what most people consider mass government
surveillance, like the cameras and all those things,
both what a lot of people
don't realize because a lot of people's idea
of what we do, especially in law enforcement
is driven off. The Internet and shows and
things like that. Yeah. There's no 1 I
work with who shows up at work and
it's, like, you know,
tapping their fingers together like mister Burns on
the simpsons, deciding how we can, you know,
do master surveillance on people,
The reality is it's a lot of not
having enough resources having too many tasks to
do. We can't even catch all the bank
robbers.
And, you know, murderers and all of those
things. Nobody's got the time to spy on
the masses. Right? So that that has been
my experience. I'm not... And you know, I
can't say that there's no hidden secret government
groups somewhere not doing things, But I've worked
with almost every... Let our agency. I work
with all the largest police agencies in the
nation, and a lot of the private sector
intelligence
agencies. We And so I will tell you
having kind of a foot in both sides.
I am more concerned about the massive
collection.
Of just day to day data off of
things like the Internet and taxes and every...
And so on the government side, when I
meet with decision makers,
The drum that I keep beating is we
need to stop collecting so much because we
can't protect it.
I am more concerned as a citizen of
the government getting my data breached
than them putting cameras out. Something like that.
Because I know that is much more likely
to affect me. Right? Now if your threat
model is that the government's, your enemy or
you know, then that probably is going to
be a different perspective for you. But for
me, it's things like, shortly after Covid, there
was a massive nationwide
unemployment scam going on where millions of people
had their identity stolen.
And that was just more incompetence
and lack of resources. So my biggest issue
with the government as far as working there
is, We do not do a good job
of predicting the data we have, and we
need to stop collecting so much. Right? It's
kinda similar to where you go to your
doctor's office, and what I have started saying
when I go to see a doctor is
when they asked for my Social security number,
I politely decline.
They do not need my social security number.
That was a tax number. Right? Mh. So
I think if we can all start bringing
these issues up of, like, why are all
these
organizations, private and public collecting so much in
the first place because
anyone who works in information security?
Or works on my side of the house
knows. We can't protect it all. Like, the
days of putting up walls is over.
So
I just think the first step is encouraging
the that the government just collect and control
less. And then I think I have to
remind us all, we have a role in
this. We have been led into a culture
of constantly trading our data for stuff.
And, like, we gotta stop using free apps,
we have to start realizing that if you
wanna a private service, you probably have to
pay for it.
And
understand the long term cost of all these
free things. The free coupons and the free
apps and the free raffle and the free,
you know, Anything that is free is probably
a bad idea. So I think we do
have to acknowledge our role in this is
we can't freely give up all this stuff
to these companies and agencies that we don't
trust,
and then really just sit back and complain.
We need to stop giving it to them
and also maybe stop giving them our business.
Yeah. Right. Right. This goes back to something
I I'd like to say a lot it
which is the only data that can't be
abused or stolen on this data that doesn't
exist. Oh if it exists, it's just it's
just waiting for somebody somehow to either stumble
across it or to hack into it. And
the other thing, I just recently interviewed Byron,
who wrote a great called means of control.
And his point was about a lot of
the corporate data collection, in further of targeted
behavioral advertising and things like that.
That is allowing
the law enforcement and intelligence agencies both ours
and
abroad,
to have access to massive amounts of data
on all of us and in the Us
bypassing the fourth amendment to do so because
they could just buy it. So
as somebody worked inside, and, you know, I
I always think of James Comey saying they're
were going dark.
For and somebody worked both sides of this,
the the people that you work with or
the people who advise, the people you train
within the system.
Are there other people that understand the privacy
risks of this stuff 2 or do they...
You know, you're you're 1 of the unique
people I would have to think that I've
seen
both sides of this and understand the harms
that could come from it. What what about
other people you've worked with and? What's what's
the culture like on the inside for for
that point of view?
Yeah. So... I mean, things have really changed
over the last 15 years. So when I
first started in intelligence,
I mean, it pretty much was the Wild
west. Right? Like, it nobody privatized anything. Everything
was out there. So especially on the open
source intelligence side. It was just kind of
like everything was freely available.
There has been quite a bit of
progression along privacy
lines and security lines as far as data
collection.
And the use of that. So what I
find now is we're in this kind of
strange place where a lot of the agencies,
at least on the public side across the
country are in really disparate parts of the
spectrum. So for example, the the agency that
I work at, I can't use any of
these services. I can't... We're just not allowed
to. It's against policy. We have an ordinance
in our city. We have a high level
of scrutiny around anything that involves data sharing,
data collection, policy of those things.
The the upside is that's a good level
of control so that we don't start just
doing whatever we want. The downside is, sometimes
these things can be reaching these policies. So
we're using super outdated technology,
which can have a security cost. Right? And
and an effectiveness cost.
So for us on the inside, it's this
constant balance of, we have to retain enough
capability to protect people, but at the same
time, we need to make... Maintain or gain
back public trust.
And depending on what part of the country
you live in, people's level of care on
that is different, the
politicians drive all of this, and I think
that's a lot of times what people forget
is, like, I work for a very large
police department.
There's very few decisions I make during my
day that isn't dictated by a chain of
command. Right? So a lot of what is,
assigned to us as tasks, a lot of
the tools we get are actually decided at
a very high level.
So as far as what people in the
community can do is you have to let
your elected officials know
that maybe you don't like the idea of
license plate readers. Maybe you don't like the
idea. And basically at a community level, you
need to make your voices heard, and I
mean, my feeling is we're in the police
department. If people don't
want us to have a tool and that
limits our effectiveness. That is their choice. Right?
And everything should just be transparent.
I think I probably... My perspective is a
little skewed because I work in 1 of
the more
restrictive
agencies in the country.
But I do travel around, and I will
tell you there is more and more attention
being paid to the privacy
implications of these things. But it is going
to vary from community to community, and
my guess is a lot of that base
is based in the politics of different communities.
And then at the national level, everything is
much more murky. But I will just say,
I I was at the Fbi for 7
years, the people there,
spend a lot of time
checking, you know, dot their eyes crossing their
t's, asking for permission. There's
a lot more worried about violating a rule
or a policy or doing something inappropriate than
they are at getting the new fancy shiny
tool. And I know that puppies aren't gonna
match up with people's perspectives. I'm just telling
you that was my experience there is everything
was very slow bureaucratic and
cautious.
So when I hear those stories, I'm not
saying that none of that stuff ever happens
that people see on the Internet. But that
has not been my experience from the inside.
So again,
I love my privacy.
I'm not so worried about the government, I'm
just worried about collection across the board. And
then I'm worried about how cyber criminals are
going to use that because
statistically, what's gonna happen to me is identity
theft, getting my accounts taken over, ex,
harassment.
Like that is what is, you know,
ruining people's lives day today. That is what
I'm concerned about for my kids.
So I try and strike that balance because
I do have that perspective from both sides,
there should be accountability for any sort of
government surveillance. And then what I keep saying
too is we need to constantly make the
conversation around appropriate use.
I will also say, like, on the electronic
surveillance side,
there's almost nothing I can do to get
your private data that I don't need a
judge to approve. Right? And again, that might
be a little different at the federal level.
But if I wanna, you know,
collect any of your actual private data. Or
if I wanna hide it a hidden microphone
or do all those things, I'm going to
need to get an approval from a judge.
So a lot of the things people think
that we can do willy nilly,
are actually already protected by a level of
authority or a court approval. At least in
the Us. I know it varies vastly around
right. I think people would be surprised about
how
restricted we are because that's not the narrative
on the Internet.
Alright. So let me let me dig a
little deeper on that and push back a
little bit. It... What I'm hearing is, I'm
and I wanna understand where this is coming
from. Is this...
Because folks in law enforcement are trained to
be rule followers, and therefore, they they they
follow the rules that are there, and how...
And look to their leaders to help them
interpret those rules and go by? Because this
happens a lot in law enforcement from what
I've read. Someone says, hey, could we do
this and it goes up the chain and
some lawyer signs off of in like, oh,
blair signed up. We're good. Let's do this.
And I and I think to some extent,
this is kind of what's don't snowed and
exposed is and they figured out some kind
of creative ways to follow the rules, and
I'm doing your quotes that you can't see.
But really
broke the spirit of those rules. What what
does your take on
on on that? Is it is it... Is
it the most people wanna make sure that
their finding stuff that's gonna stand up in
court that's gonna be ad miss, so they
can get the bad guys, and they wanna
make sure that some lawyers... Somewhere signed up
on the policy or
are there really people in
the law enforcement who say, you know what?
This is... This might be legal, but it's
not right. Or this this this seems shady.
With with so what's your take? Yeah. So
we actually have these conversations quite a bit.
And and to clarify, because of my role
in my agency is a little bit more
of a lead role. Right? Because I've been
doing it for a long time. So I
am part of a lot of these conversations
with commanders, city leaders about surveillance. Right? Cool
we have a lot of discussions about this.
And I will say, I've definitely witnessed
kind what you're talking about, which is
I'll I'll give you an imaginary example that
reflects
similar situations that I've seen in real life.
So
we have our child exploitation unit. Right? And
there is no unit and law enforcement that
we can... You know, more so get universally
behind. Right? Yeah And so I'm using that
as an example because that is the example
where everybody,
in the community online, everyone agrees, like, yeah,
We need to catch these predators type of
deal.
1 of the dangers of doing that kind
of work is,
1, the detectives get burned out so quickly
because they have to see such horrible things.
But 2,
You always have to be careful every time,
anytime you have an emotional investment.
Now
every time I meet a victim, I have
some level of emotional investment. Right? Because they've
been, you know, rates stabbed robbed all these
horrible things, but there's no level of empathy
that's gonna be deeper than, you know, when
a child's harmed
And so
what you can see in those cases sometimes
is
detectives or officers.
I don't often see them color outside the
lines, but I could see them, like you
said, like, technically, we can do this thing.
And if we're ever gonna do it, it
shouldn't we do it to protect this child.
Like that type... That's... Yeah. Right. That's the...
In and I think that's where people would
start to be, like, oh, that can be
a slippery slow.
Now in my organization, we have so many
checks and balances.
So
anytime anything is on the fence, it gets
kicked up to us and those of us
who have been doing this longer. And just
as my offensive
experience helps my privacy
perspective vice versa. Right? So I'm usually the
person in our agency who is bringing up
the privacy concern, and we have those conversations
about you know, yes, technically, we can do
this, but should we do it? Yeah. And
when people come into my squad and we
train that up. Train them up. That's 1
of the first things I try and teach
them is it's not... The first question should
not be how can I do This? The
first question should be should. I do this.
Now,
I'm not gonna say that that is something
universal
through law enforcement that people are doing, but
it is something we're trying to promote. And
just like everything else. Right? Cultures are are
slow to change.
But I will say most groups I've worked
with naturally,
seem very professional, very responsible.
But we always will have a bad apple
here, a bad apple there, or... I mean,
we've all... Everyone who's listening to this has
worked with people. Right? And in any organization,
you're gonna have some people who are bad
at their job. Right? Like, it just... There's
no getting around it. So
I do occasionally find myself cleaning up messes
where someone got a technology they shouldn't have
been able to get or someone
colored outside the lines.
And my feeling on that is we just
have to own it. Right? Here's what happened?
Yes. This was this was a big mess
up, and yes, there needs to be accountability.
We own it, have the conversation, learn from
it and move on.
So it is it is definitely an issue,
but I think
overall, my feeling is we're going in a
good direction. We definitely have much more accountability
and constraints than we had 10 years ago.
Yeah. And I... To me, it almost feels
like...
And I guess you've been around long, if
you may have seen this Be curious to
know if you notice the change.
After 09:11, there was definitely this notion of
never again. And I I think that our
intelligence law enforcement, certainly federal level.
Felt that they were... That they missed it.
That this is something they possibly could have
prevented or mitigated and they didn't. And so
I I think that was a lot of
egg on the face of
of those agencies And I think a lot
of them over rotated the fact, okay. I'm
never gonna let anything bad happen again, and
I'll do whatever to make that happen. And
I think
I... While I understand it, it it it
feels like being parent and your parent, and
and in the so you, you know, you
don't want anything bad to ever having your
kids. But that doesn't mean you lock them
in a box and put and put a
camera on them all day long, so nothing
could ever happen to them. Right? I mean,
there's Yeah. There's freedom issues around that. And
there's there's... Quality of life issues are around
that. And and I think that as as
a people, we need to
say, you know what's it's okay
if you don't catch everybody because
to catch everybody, you would have to make
our lives miserable, and we don't... And that's
all all life worth living. So so I
will tell you on our side,
it is like, there is no time in
my career where it's felt okay to not
catch someone.
Like it that is... I appreciate, like, that
sentiment, but the reality is,
basically, you know, again, probably like a lot
of other
jobs.
You tend to be held accountable when you
mess up but you tend to not really
get credit when you're successful, Like, it's our
mistakes that mostly rise to the surface.
And... But I I will add this. It
is definitely a balance.
And, you know, the kind of the similarity
I would use or the metaphor would be,
in the security world, 1 of our biggest
obstacles is the balance between convenience and security
because they're dia opposed. Right? Mh. And this
is a almost the same deal.
We could definitely protect everyone more if we
have more tools, and more regulation and more
all of these things. But again, I don't
wanna live in that world either. So I
think there definitely is a bounce there in
then I think with the conversation is where
should that balance be? Right?
And
I think there's a lot of work. Then
still to do there. And then, you know,
we have issues about, you know, a lot
of historical in equity. We have all sorts
of things we need to address and deal
with And at the end of the day,
we... I think the most important thing is
we all just acknowledge wow. This is a
really complex thing.
Yeah. And then, I'll just throw and another
thing that's really odd about working for the
government.
Your top
level leaders
rotate through constantly.
And some of them have no experience in
your job. Like, mh. It is the strangest
thing to have decisions sent down to you
from people, who have 0 experience.
And so
that to me, you know, I've I've been
doing my job for over 25 years
I've seen a lot of that. And, you
know, oh, we have a new elected official.
So now we're gonna do things a different
way. And
I always say at work, like, could we
plea finish some things before we start new
things,
we could be much more fiscal responsible if
we weren't chasing each new ease you know,
officials big idea. Right. So government definitely has
a lot of problems. But in my experience,
I I think are... We have bigger issues
with just being not having enough resources,
you know, not being good at our job,
being inefficient
and kinda of being chaotic.
Obviously, the bureaucracy.
And I think those day to day are
the issues I see that I think we
should work on. And I think the other
issues, like the big
ideological issues. We just need to keep having
conversations. And like I said, everyone in their
communities
share your thoughts on it. Right? Because again,
those elected officials are the ones who are
gonna give me my marching or. Right? They're
gonna tell me what I can do, what
I can't do all of these things. Right?
And
what people don't realize too is often behind
the scenes what they don't see is that
same elected official meeting with me saying, hey,
I kinda want you to go put all
these cameras out or do all these things
because, you know, the people in my community
are being targeted.
Right? And so there's definitely a juggling act
we do trying to strike that balance, and
we're not always successful. You know, sometimes, I
feel like maybe we're over reaching a little
bit. Sometimes I feel like we're under reaching
and just not effective. So
I like the idea of each community.
Figuring out and sharing what they're... What they
want. Right? Because not all communities are the
same. Maybe some communities are more comfortable in
you know, prioritize
safety over privacy.
You know, for me, I'm about 50 50.
You know? I I want a reasonable
amount of, of support from the government. I
don't want them in all the aspects of
my life. And generally, I think regulation and
things like that is not a very efficient
way to get things done.
But I think I I think you make
a good point. And I will call call
out that I... That that is why that
is why politics and voting matter because
as weird as it is, I can certainly
understand for your perspective or having a political
point to you may or may not have
any real experience in the job that they're
leading or in the organization that they're leading,
you can as a voter as a citizen,
make sure that the policy is set at
that... The policies are set at that level.
And so if you if you wanna change
policies, that is your avenue to do so.
And so I guess, maybe that's why they
set it up the way they do. Don't
I don't know.
Okay. We could fly,
on this kind stuff for hours. Absolutely. They
probably better done over several drinks at a
bar. So. Let's let's move on to some
more practical matters. If if I wanna do
a full dossier on somebody, and, you know,
okay. Fine. Let's say it's me.
Just just to see what's out there, and
maybe to make, you know, settle people's nerves
about the other I think of it. So
if I if I to a full dossier
myself. If I wanna find out what's out
there. What information
is most helpful as a starting point? Is
it my of email address? Is it my
full name? Is it my cell phone number,
social media handles? Maybe social security and would
them might be harder to get. What
what what information is is best at a
starting point which could be most revealing and
then kinda walk me through the progression of
how I would... How Would go about how
you would go about.
Saying, okay. I'm gonna I'm gonna do a
full thing on Kerry parker. What would I
do?
Yeah. So
a good way to think about this is.
Every time you create an account online. Every
time you
get an app. Every time you do anything
that involves the Internet, What does it usually
ask you for? And it's almost always gonna
ask you for an email address or a
phone number.
Therefore,
almost all online accounts in court content tied
to individuals are associated,
almost always with an email address. And because
email addresses tend to be unique, content Right?
Like, you don't have 10 people with the
same email addresses. The combination of that being
so ubiquitous and being a unique identifier almost
always makes that. I would say my favorite
lead like investigative lead or intelligence lead.
Now phone numbers are very important too because
every all the credit sector
on the tech side wants people in the
mobile ecosystem. So
almost every major social media platform is forcing
people into giving phone numbers. Because they want
to me on your mobile phone. They want
to me in your face every 30 seconds
all day long. Right? People So phone numbers
can be useful. 1 of the challenges with
phone numbers doing Os work is there in
so many different. Formats. Mh. So when you're
trying to search for them, it can be
pretty rough. And this is 1 of the
reasons I I prefer an email address because
sometimes they'll have parenthesis. Sometimes they'll of dots
and hyphen.
The plus or plus country code. Yeah. Exactly.
And then the other issue is of because
it's so easy to port numbers now and
people use V numbers, voice over Ip numbers
so often
that We get a lot of
misinformation when we search at phone numbers. Because
the phone number I have on my burner
app this year might have... Have been your
cell number last year.
So the numbers are a lot more dynamic.
Mh. And then, obviously, any sort of social
media lead. So usually might... If I your
email usually, that will get me to your
social media accounts, but obviously, 5 year Twitter,
Facebook, all of those things.
If you... As far as names, and that
could be a real name or a username,
they're only valuable from an offensive perspective if
they're unique. Right? So if you're Dan Smith,
like that does nothing me unless I can
narrow it down, like geographically.
Same. If you're sniper 22,
that's probably not gonna do a lot too
for for me. But if you have a
very unique username
or a unique real, and especially if I
get any kind of other filtering factors such
as your hometown. Then I'm gonna be pretty
much good to go. So typically, how we
do these things, we take whatever, we call
it seal
information. It is our lead. Right? Like, you...
Let's say you sent in an email threat
to a public official. They give me a
copy of the email. I'm gonna look at
the body of the text for any vernacular
that's interesting. But largely, the first thing I'm
going to do is I'm gonna search that
email address. I'm gonna see what its
reputation is? And that means how long has
it been seen on the Internet. Where has
it been used? Then I'm gonna find the
social media accounts. And then I'm gonna burst
image search, your profile photos. Right? Because what
is a profile photo? It's the photo everyone
uses on their accounts because it looks better
than they actually look in real life. Right?
So we have all those techniques, and then
that's called pivoting all So basically, I... If
Find 1 of your accounts, I'll collect other
leads off of that and pivot, search on
those.
And pretty soon. I've got a Dossier or
a report, listing all your accounts, your addresses,
your employer, your family members, all of those
things. And that would usually be referred to
as like a due diligence reports. Like, something
you would do when your background someone,
but often what we tell people to do
on the privacy side is, do your own
intelligence report on yourself.
I hop onto our site, use our tools,
start collecting all your exposures.
Absolutely make sure you store this in a
safe location. Don't put it in the cloud,
don't put it online. I like putting it
in a paper journal, and I could say,
okay. These 10 sites have my home address.
These 2 sites have my phone number. These
put 5 sites have my kids names. Right?
Mh. And then we would go through and
triage that. And then on our site, we
also have a full free guide on how
to request that your data be taken off
people search engines, and people search engines are
essentially sites populated by data brokers,
So we've got the top 200 data brokers.
We tell you how you can go out
and have your information removed or at least
try.
But I'll warn everyone. No 1
Well, definitely no 1 my age. Right? And
I started in the nineties, so you can
probably guess how will that. No 1 my
age is gonna clean all their information off
the Internet. It's just not possible.
But you can clean a lot of it,
and it's definitely the type of thing we
recommend people do themselves.
And it's also a good way. You know,
you talked about knowing both sides.
This is a way. If you do your
yourself assessment, you can use the tools off
our site, you can kinda try your hand
at doing a little o source intelligence while
improving your personal privacy and security,
because you're gonna basically figure out what your
fin exposure is. Right? Your tax surface.
And then we're gonna, you know, give you
some free documents and go buys and guides
to help you clean those up.
What are some ways the people over share?
I'm thinking particularly social media, but it may
happen other places too. You know, 1 of
the reasons that I always hate the idea
of the 3 security questions
you know, for account recovery is most of
that information you can probably find on somebody's
Facebook feed.
What town they grew up in? What was
their dog's name in high school? What was,
you know, what's their maiden name? You know,
what... You, a lot of that information, what
school do they go to an elementary school?
You know, some people over share a lot
of that stuff. And and I would think
that a lot of information, if you knew
what you were doing, you could find it.
So how do people trip up
in in the Os world and give away
too much information. What are some common ways
that people over share?
I think social media is at the top.
I mean, really everything you do on social
media is exposing you. Right? Unless you are
doing it under a... Fake identity like an
alias or we call those burner accounts or
puppet accounts. And even then you're still gonna
probably be connected to people in your lives
and those human connections are things that can
be exploited.
So 1 of the, you know, most prolific
cyber crimes obviously are things like for fishing
and things like that. And sometimes what people
don't realize is
the person who targets you, you have maybe
come into their cross hairs because they've already
victim someone else in your life and because
all of our interconnection are online, we like,
if someone in my group gets exposed, we're
all typically then attacked. Right? It's definitely a
a weakest link. Thing.
So I mean it's sort of a tough
question because the honest answer is all the
over sharing online is problematic from a defensive
perspective
the thing is, though, and I... I'm not
the guy who's around when I'm doing my,
you know, my keynote and my privacy events.
I'm not the guy who says, if you're
on the Internet, You're dumb. You need to
get off the internet. Right?
So
I acknowledge... Like, because I'm a middle of
the road guy. I mean, honestly, once you
have kids, your ability, d to be private
as. Right. Shy anyway. Right. Right. Because you
got all the, you know, soccer leagues and
pot legs and and other parents could But
what I would say is
having your accounts is fine, but so few
of us go through and check all the
privacy and security settings. Mh. And the nice
thing is, in the last 10 years, the
privacy and security settings have become much more
intuitive,
but we still have to check them because
we all know every time Microsoft doesn't update
or Meta doesn't update. Like, magically boxes get
unchecked. Right? Yeah We
check all those. So I don't think it's
generally a problem to have social media and
things like that. Social media is definitely your
probably your biggest exposure for most people.
If you go in and lock it down
so that you are controlling who can see
what?
We don't. I will tell you on the
offensive side
because, right, I'm a good guy. We don't
hack people. We're not cracking code. We're not
doing any of that stuff. So if it's
private, it's private. Right? Mh. And I I
have people that come to me for training
and and they're, like, tell... How to get
to all the stuff that's private and the
first thing I say is, if it's private,
even if we could get to it, legally
we can't get to. Right? So unless we
get owns warrant or a subpoena or something
like that from a court.
It doesn't matter that, you know, figuring out
the technique because we are not hackers,
Right? We are not breaking into people's account.
What we are is very, very good at
finding the stuff that is
public.
So right. Your best move on the defensive
side is make as much not public as
possible.
Right? So checking settings, I often say, you
know, when I'm talking to groups.
If you do just a few things, you
can mitigate 98 percent of your privacy and
security exposures. So 1 thing is checking all
your accounts and device settings, Just checking them
and making logical choices,
do it periodically as you said because they
change. Yes. And then as you know, using
a password manager and having unique long past
phrases on all your accounts.
Eliminates another, like, 50 percent of all attacks.
And then if you have multi factor authentication.
If you do all 3 of those things,
And then the fourth 1 I always tack
on to is listening to your gut.
So anything that
communication that is urgent, is almost certainly fishing
or a scam. Right?
If you do those 4 things,
check your settings on accounts and devices
password manager, all new, long, unique passcode on
your accounts.
Mfa on every account that takes it and
listen to your gut. Your 98 percent bulletproof
on the Internet. So, you know, because a
lot of the groups I talked to you
aren't
like, technically advanced folks. Right? They're from the
insurance industry or accountants or those different things.
That's what I always like to leave them
with, and that's the same advice I give
my mother lots, the same advice I give
friends who don't work in this industry. If
you do those 4 things, you don't have
to overcome them locate it. Because what I
found is,
you know, if you try to do extreme
privacy like Michael
Biz patel.
1, you're probably gonna fail. 2, you're gonna
be super frustrated.
3, he works on that every single. Day.
It is a lifestyle. So I think setting
reasonable goals and reasonable
expectations in
in the metaphor I was used is I
love hiking. Right? That's my favorite personal hobby.
I know, again, weird to talk about private
things in the public space, but for context,
I love hiking. So where I typically hike
his bear country, and I have friends who
carry, like 40 fours is in their belt
and that always makes me laugh a little
bit because even in law enforcement, most people
can't hit shoot very well under heavy stress.
Nobody's gonna... Hit a bear when it's running
Adam unless they train all the time. So
my rule of thumb is
hike in a group. Don't be the slowest
runner. Right? So cyber
is the same.
It's not about being completely bulletproof. It's about
just being better protected than everyone else.
Well, I... And the other thing I wanna
a call back to you that you said
that I think is it's important that I
like to call attention to do is that
privacy and security are we things not me
things. They we... That your security and your
privacy overlap mine. If you
if you mess up, then you you make
me vulnerable. But by the same token, if
if If you do better, you make things
better for me too,
and in vice versa. So it's important that
I think that even if you don't worry
about yourself, It's important to understand that everybody
in your social graph is also affected by
what you do or don't do.
It and it does spread like in a...
Good way. Right? Like we Right. Like, my
oldest is in college now. And for her,
the things she used to I at me
or every once in a while, I'll see,
like, kinda pop up, just some things she
picked up, Like, when she was in, you
know, a sophomore in high school, while she
could... Or cared about was getting to Netflix
without dad's firewall blocking her. But now, I
see her interacting, like, with her friends and
helping people with their password managers and all
of those things. So I think even if
you don't see it in the moment
by walking the walk in our friend groups
and family groups
like we are infecting those around us with
good digital hygiene habits.
Right.
Okay. So we we talked about social media
and things that we actually kinda actively do.
But there's another area of that I wanna
make sure we talk about, and that's something
big... I think a lot of people don't...
I have a good grasp on. That is
public records like government public records.
This is the reason why if you're get
in a car accident, All of a sudden
you're getting all these you know, email some
lawyers wanting to represent you or, yeah, you
know, when you get divorced or buy a
new house, you get all these things for
He lock, And, you know, it... There are
public records that expose you. So
in in the old days though, when I
say old days, I mean, like, you know,
because when we were young, You know, maybe
were 20, 30 years ago, you would have
to to get a public record, they were
public, but you'd have to, like, physically walk
down to the county courthouse when file a
form, wait a few minutes, maybe for lucky
and get and get a copy of something
and and maybe Pay fee. Or, you know,
maybe you could actually maybe even back then
you could send a mail. You something through
snail mail to to get a record. But
today, they're all online. And a lot of
times they're all free. What is the implication
to our privacy for that?
Like, what kind of public records maybe we
not thinking about that the where we could
be exposed.
The that are freely available? Your voting record,
for example, property taxes? There's so many things
that are online. Help us understand what that
that attack service looks like. And then
should we... Do we make a mistake? Like,
is it a bad thing to have all
this personal stuff that available show? We be
rate limiting people, so they're not being scraped
or, you know, I don't know what other
defenses is against this?
Yeah. I've I have strong feelings about this.
So,
I actually spend a lot of time in
my days
responding to things like, Fo. Right? Because. My
state that I'm in has a a pretty
overly broad,
fo and public disclosure
law.
And so we basically give everything. So anyone
can basically request anything they want from my
agency and we red reject almost nothing.
And that can be very problematic right? Because
if you're 1 of our customers, and in
my case, that might mean you're a victim
or a witness.
We're gonna just give away your details. Right?
So you're the the witness of a shooting.
You haven't done anything wrong, but we collected
your personal information so we can contact you
interview and, you know, have you as a
witness in court.
I think 1 of the all the high
level issues that has caused
a disparity in
transparency,
versus privacy is that years ago most government
agencies decided transparency was the most important thing.
So their idea was
everyone should be able to see everything because
that's transparency and accountability.
Well, those laws
were meant so that we could hold
are top level officials accountable.
It... They were not meant so that your
neighbor could dig into your police report and
see your details And so what I found
is and this is anecdotal, but in my
experience, most of the requests we get are
not about holding top level government to... Know,
the most powerful people accountable.
It's a lot of, like, little petty I'm
digging into your stuff and I'm, you you
know, pulling up your voter records I'm pulling
up all this. Voter records are a huge
issue because in a lot of states, they
either sell them, or you can go download
them for free,
and you're required to provide your a true
residential address or you're committing a crime when
you register or to vote which means you
can basically find
anyone's home address in any of those states
if they have a unique name at all.
And a lot of states are now starting
to also share things like dates of birth,
and, which is a credential. Right? There's a
lot of things where you give that up,
to verify that you are who you say
you are. So... Right. It is a huge
problem. The difference between now and 20 years
ago is it's just all more accessible
online. And so again, I'll repeat the earlier
piece. I think as government, we need to
collect last, but also, we need
drastic changes in our Pd fo laws so
that we're still able to hold the powerful
people accountable,
But we're not making it easy to mine
the data of just the general citizens.
Right? It it wasn't meant to be that,
but that's how it's being used.
Wow.
Okay. So you kinda of made the
the thought that there's there's so much data
out there, and it it it could be
hard to get through, but
we've got tools for that now. I mean,
we've got computers. We've got Ai
for for that now. So where we used
to have these massive haystack stacks and there
might be some needles in there somewhere, and
I and I've heard arguments that 1 of
the downsides to mass surveillance that we collect
so much data that we actually lose the
good stuff instead of focusing
criminals, for example, are focusing on, you know,
trying to smartly gather the data. If we
just hoover up everything. All of a sudden,
we've got too much to sift through on,
I'm not sure how much that argument is
gonna gotta gonna be around much longer, because
we actually had the compute power and things
like Ai that is really good about sift
through data and finding patterns and things.
So how much of the kind of work
that you do
can be automated today or
in the very near future such that attacks
by fishers and things like that could be
much more automated.
Yeah. So
first of all, Just wanna say you're absolutely
right. Like, on the government side, especially the
law enforcement side, we should be using a
scalpel, not a hatch it. So I absolutely
agree. We should be collecting only what we
need, not collecting hoover up everything. That is
definitely part of... The problem because also it's
just super inefficient. You're exactly right on that.
Right? Now now I'm creating just massive number
of haystack stacks I have to dig through
through.
Ai is interesting. Like,
I am not a big believer in Ai.
I think most of the things touted as
Ai true You know, we've got the large
language models, But I think it is a
lot of marketing
around a lot of this stuff. I think
most of these are not fully. Baked. I
think we're, you know, still some years away
from them being useful.
I see some people talking about using Ai
for open source intelligence work. I haven't been
impressed by any of it. And I think
1 of the
unintended consequences of Ai is going to be
massive data pollution on the Internet because we
already have an over on overwhelming issue with
misinformation and
disinformation. Yeah. And now it's just becoming
exponentially easier to create massive amounts of content
with no accountability, no sourcing, you no, quality
control,
and so We all know that currently, like,
your results on the Internet, you know, sometimes
they're just trash. Right? They're just
obviously wrong. Yeah. And
Personally, you know, as someone who searches on
Google and places every single day.
I have felt over the last couple years,
my results are just getting
more and more
less specific, less focus, more water down, more
garbage,
and
I'm getting
exactly the opposite of what I want, which
is I wanna be working with that scalpel.
I wanna get just a little bit of
information I want.
So
it I think Ai has limited usefulness
on the offensive side of work on the
intelligence gathering currently.
I'm keeping an eye on it. I'm more
concerned about it from a cyber crime perspective
because I am seeing it being used by
cyber and campaigns.
Because now you can use... You know, maybe
I don't even speak your language.
And, you know, 2 years ago, what I
would have done is go on some criminal.
Forum and pay someone 10 dollars a bitcoin
to write that ransom email. But now I
can just use Ai. It will Yeah. Help
me with the code for the ransom.
It will right than ransom where. When I
do keynote, that's 1 of the demos I
do is I have the... Now the Ai
writes up, a ransom note that we're going
win to send because we walk our audience
through how we do a massive phishing campaign.
So
the this... Ai is just building on what
we were already seeing in the crime as
a service
industry. Right? Because I I think you probably
talked about that on here for where... Oh,
yeah. You don't even need technical skills now.
And this has been true for a while.
You can use bitcoin or crypto and buy
just about every or
skill and tool in part of a cyber
crime campaign pain. And now Ai just makes
it easier.
Gotta wrap this up unfortunately. So... But let's
wrap this up as practical advice. We've already
talked about some things some of the top...
You gave your top 4 choices for things
that you tell people to do. Let's let's
talk about a few more things. For example,
can you
delete or limit access to all the data
that's already out there? You've got a list
or a great list for data removal tool.
On your site, were you actually given it's...
There's a lot of sites. Like, literally, I
think multiple dozen.
Websites that you tell us to go to
it. But you do say, of course, that
there's also maybe these dozen are actually the
top ones and some of those scroll down.
So
how do we know where to go it?
And then some people to look at that
and say, well, why don't I just go
to, like, delete me or in Cog or
some of these other ones that are offering
to do it for me. Yeah. Cost money,
but I don't wanna do it. What Should
I just pay someone else to do these
things?
Yeah. That's a good question. So I get
asked about life lock all the time, delete
me all of that? So a few years
ago, I tested some of these. I actually
put signed up, paid for and went through
some of those so that I could speak
confidently and from a place of knowledge
about them. And I'll tell you. So these
services all work the same. You have to
give them a bunch of your personal information,
and they say they're gonna scour the Internet.
Now everyone says also dark net, Ai, and
they throw out all those buzz words. And
they're gonna protect you and some of them
will off I say they'll freeze your credit
and identity management. All these things. They they
all make big promises.
But they all collect a bunch of personal
information, and then they have scripts and automated
services that go out, search for it, all
and then they auto generate
basically, emails and letters that get sent to
the data brokers requesting that your data be
removed.
They sell this for, like, 200 dollars.
And so my first
thing I wanna share on this is, you
cannot...
Clean up your privacy effectively for 200 dollars.
Right? You are absolutely getting what you paid
for. So the reality is this. So when
I tested this out, sure, you know, I
used 1 of these services.
It removed my information from about a dozen
different data broker sites. You And in full
disclosure, I done a little cleanup before that
myself, so I didn't have a huge amount
out there. And then if you keep paying
the money each year, they will... You know,
look again because what happens is the data
brokers tend to basically buy new blocks of
data. Right. And then it just circulates to
the time. Right. So
my big takeaway was this.
1, I had to send them a huge
amount of personal information. 2, they only remove
just a little bit of low hanging. Fruit.
So it was better than nothing,
but it was not super effective.
It definitely did not
wipe all my stuff off the Internet. It
just did the low hanging fruit.
My big concern with this is
what happens when those companies get breached.
Because you're giving them...
Like, could... In order for them to search
for all your exposed info, you have to
send them your info. And so any of
it all. Yeah. The Irony. And also when
you start to look at, you know, some
of the business dealings, parent companies, all of
that. Yeah. Yeah. So we... The in our
business, we advise all of our clients
against this. We think you should handle your
own privacy because it's your privacy.
Right? Why would you trust a third party,
and I'm telling you anyone for 200 dollars
cannot do a good job at this. And
for 200 dollars, how... Much effort are they
putting into protecting your data. Right? So you
get what you pay for. So
let me give you my quick kind of
8 steps.
If you want to this weekend,
start tackling this and how I recommend is,
like, don't try and do it all in
a day, spend a couple hours this Sunday,
Spend a couple hours the next Saturday. But
this is basically it. Right?
Start a privacy journal, as I mentioned before.
Number 2, freeze your credit, but That mitigate
about 95 percent of identity theft in the
Us, you are allowed to freeze your credit
by law. This law changed a few years
ago. You do not have to pay for
it.
We have instructions on this in our privacy
guide on the site. So you can just
download it and follow our steps.
Do self assessment. Log on to our site,
use our dashboard, search for all of your
exposures, Put those in your privacy journal. K?
Now you're gonna go through all your devices
and just double check all, your settings.
You're going to get a good password manager.
I recommend bit warden. That's what I use
for me and my family. It's open source.
It's affordable for but pay for your password
manager,
like, we wanna move away from free tools,
especially when they're for security.
And then you're going to go through all
your accounts, update them with a good unique
strong passwords. And then the last step is
Mfa. You can use Auth, You can use
Google
Authenticator.
And then gonna stop using free apps and
services.
And then my... Again, my number 1 thing
is,
and this is what I always talk to
my... They're Daughters about growing up is, I
was like, you know you're walking down the
street,
and you walk past them dude, and the
hairs go up on the back your and
neck or the dog g.
Listen to that. That means something. So my
number 1 thing is when you get that
email and when you get that text, and
it has any sense of
urgency
please please please
stop for 30 seconds in pause and thank
is this odd
because it's almost o always going to be
a scam if it is,
you know,
instill a sense of urgency or it wants
you to click on something or oh and
something. So
in my day to day cyber crime, job,
both doing investigations and mitigation. Fishing is still
the number 1 and it it causes the
most ransom.
That causes more damage than just about any
other form of cyber crime. I do see
a lot of like, sex ex as well,
you know, I send you the email.
Hey, Carrie. I hacked your computer. To prove
it here's for your passwords.
I can see all the porn even looking
at, and I'm gonna send it to your
family on Facebook.
And the reality is I just pulled your
passwords out of breach data, and didn't hack
your computer. It's a... It's... I'm bluff looking
So... But that sex distortion scam we see
happening all the time. And then of course,
we're still seeing a lot of...
And this is 1 of my... This makes
me so angry.
Tax un vulnerable
populations. You know, people call grandma, little Johnny's
in a Mexican prison send us gift parts.
We still have
older victims every single day going into best
buy to get gift cards because of those
type of scams. So... But that... That's pretty
much it. Everyone listening to this can take
control of their own privacy and security. It
just takes some work. And what I just
wanna promise you is it's worth it. Right?
You
at the end of doing your own privacy
cleanup will
understand
what situation you're in? How exposed am I?
What is my threat model
Like, you will feel more comfortable and safe
if you do it yourself. Don't pay me
to do it. Don't pay someone else to
do it. Just do it yourself, and and
we've got all the free guides to, walk
you through it. So you'll have everything you
need. Well, I will get all those links
to put up a show notes for for
the audience, so they will definitely have access
to those immediately
Great. 2 particular questions that that I wanna
ask. First of all, I like to... You
talked about alias basically We didn't call it
that, but you'd because... Well, you implied actually
though it's a good thing. If you've got
unique email. Most people probably only have 1
or 2,
unless they've taken steps. Most people probably have
1 phone number. Now, it's mobile number, and
it's and you never change it because you
ported it everywhere, and it it follows you
for life, like a social security number. So
a lot of the things that I've often
had recommended our Alias. You getting
throw away numbers, will not throw. Your second
numbers, our third numbers are at least, so
you can kinda
diversify
your phone number identity as well as using
email aliases.
So curious about that.
1 thing in particular I'm worried about now,
especially with Ai is I like to buy
no buy domain names.
That I could do catch all email addresses
that I just make up on the fly.
I'm just... I'm waiting for the day though
when someone figured out,
what if we just... What, this is a
weird domain name so What if all the
addresses at this domain name or the same
person? Is is that gonna bite me at
some point?
I mean, anything we do that has a
pattern?
And can be tied back to anything that
is officially associated with us whether it be
financially tied or online or anything else could
be an exposure
But let me let me take a step
back and give you just, I guess, a
little advice.
So
for emails, I use simple login. Which is
owned by proton. Right? I know you probably
have a lot of proton users. Yeah. I'm
a big proton fan, Swiss privacy loss so
much better than the Us,
we have vetted them. They've been independently audited.
So
simple login was a third party company that
they acquired a couple years ago. And it
basically allows me to create an unlimited number
of temporary burner addresses that just forward to
my real email address. And the tactic there
is so many places get breached. Even if
they don't intentionally misuse your email,
so much better to use that burner email.
That just forwards through because now when Jason's
online hunting you and he finds that burner
email, it's not associated with anything else so...
There's nowhere way for it to go... For
him to go with it. Right? That's that's
not useful as an investigative lead. So if
I'm am hunting you
using aliases,
whether it be email addresses, or I use
my pseudo for extra phone numbers,
so. If I if I need to sign
up for anything, and they want a phone
number.
And and, literally, if you had ask me
for a phone number prior to doing this
interview, I would have given you. A V
number. I would've have given you a burn
number because it's not that I don't trust
you, but there's no reason in most cases
to give anyone my actual cell phone number.
Because once you have that, there's a lot
you could do with it. Right? Like, you
could sim swap it, you could, you know,
that is, a your true cellular phone number
is pretty valuable, so we try not to
give that out as much as possible.
And then you know, I like to have
most of my... I do have a couple
of personal social media accounts. For example, I
play on a sports team, and they
absolutely well, only schedule things on Facebook.
So I do have a Facebook account. It's
not my name has no photos has no
association with me.
But I choose... And I know that's a
little bit of exposure. But again, that's... I'm
not the guy who says don't be on
the Internet. I'm saying, all just be smart
about it and find that balance. And for
that balance,
I choose to have a couple social media
accounts and just not just check the settings
and don't over share on them.
1 more question and and when...
It's back to kinda what we're talking about
before, and some the irony of trying to
protect your identity. When you go to some
of these sites, And even some of these
sites, if you were go directly to, let's
say, Facebook. I gotta close my account, I
want you to get rid of my all
my stuff.
A lot of times, I'll say, well, we
really need to make sure that you are
who say are before we do this. So
upload a photo Id or upload a picture
of your passport.
Or, you know, in the process of verifying
that you are who you say you are
and that the information that you want to
have removed, it is accurate,
they ask you to basically kinda give up
a lot of information yourself. Is that is
that just part of the deal like, should
you hesitate
when you're going to into on of these
sites that want all this information to ironically
remove your data. Is that just par for
the course?
Yeah. So you should definitely hesitate.
That is something for me, like, if on
my personal burner accounts if I got those,
I would just walk away. Be like, well,
no. I'm good. Like, I'll just click that
account out? I'm just done with your platform,
especially with places like meta?
I mean, why do you think they're asking,
for a face shot or a government Id.
Right? Obviously, it's for facial recognition, and I
I do not trust that that is all
just to verify me. Right? They wanna get
us in their data database because that data
is so valuable.
And
especially Meta has really been pushing facial record
condition for a long time. Right? Ever since
tagging people in photos began.
So I don't trust that. I don't like
that
Now I will give you a little pro
tip.
1 thing I do, which probably most people
don't do is sometimes I go in and
actually dig through the terms of service.
And if you start digging through, especially on
meta, like, if they ask you for your
government Id, to me, that is a huge
over reach. Right? Like, they don't have the
authority for that. And I guess their argument
would be like, well, you don't have to
give it to us, but we also don't
have to let you back into your account.
But if you look at their terms of
service, they'll accept a government Id or 2
forms of secondary Id and secondary Id can
be.
Mail, like mail that's been open to an
address, Mh. A gym card, you know, some
of those things. So once we start getting
into non government meant Ids,
then it becomes a little bit easier to
provide
verification for something that may be in an
alternate name.
Right? And so you can get a little
bit creative there. More often than not when
these situations come up, I just walk away
from that account.
Now if it has your personal data on
it, and they're not allowing you to close
it, I've not run into that scenario.
But typically, what I would do is if
they lock me out is just put in
and and just hound them about getting the
account deleted.
But
mean, my perspective is maybe not the best
because I don't really have any social media
accounts where I post personal
details.
So the data I have on there. So
I guess, I'm kind of addressing it up
upfront by just being careful what I give
them in the first place.
Yeah. I actually struggle with some of that
to too because a lot of the advice
I give to other people people's hard. I
can't check it because I haven't done it
or I'd stopped doing a long time ago.
So sometimes have to set up dummy accounts
or find people I know that do do
it and Can't Yeah. I know that are
willing to help me look at their stuff.
And III should throw out just a little
bit of warning to your audience.
Absolutely, we should not lead... Social media accounts
follow. So we should not walk away from
them and not close them because we do
see a lot of crime that's generated of
these carrie abandon
Facebook account 5 years ago. I figure out
his old password through breach data. I get
control of his account. And now I contact
all his family and friends and start doing
a bunch of social engineering campaigns. We see
a lot of social engineering that are from
compromised accounts. Mh. So definitely...
And there is there are sites like a
account killer and some different sites that will
help you that. Help you shut down your
accounts.
As far as domains,
I do all my hosting through a company
called host matters because they're twice as expensive
as, like a Godaddy or named cheap, but
you can buy it with privacy dot com
cards, which are masked credit cards. So you
don't have to give them any of your
real information.
But you are paying them. They're getting paid.
And they have real people there. And by
that, what I mean is, you're gonna pay
with your privacy dot com masked credit card,
which for people are not familiar. It's basically
a private version of, like, Paypal almost. Mh.
And
they're gonna do a fraud alert, but if
you contact their customer service,
usually within 5 minutes a real person is
on the phone with me, and they... And
you tell them you're a privacy ent.
That's why you're using privacy dot com, and
they will approve it and push it through.
Phone And I've been using them for a
few years. It cost twice as much as
those other companies, but they don't sell our
data, and it wouldn't even matter if they
did. Because I don't have to give them
a real name. I don't have to get...
The credit card I gave them expired 2
hours after they used it
that's the beauty of those masked credit cards.
So that's my pro tip for domains host
matters. I don't own stock or anything.
I'm just...
I love when I can talk to a
real person,
and we have enough of our clients that
do business there. If you just say or
privacy and enthusiasts, they'll take care of you.
And this is this is a big message
to everyone.
I have started paying more than I used
to have to pay for things to get
the to privacy
respecting
version of it. Yeah. I think we've all
been sold into this idea of everything should
be cheaper free.
And that is at the cost of our
privacy. So if you wanna be a private
person, you have to be willing to pay
for your services.
Yep. Yep. Sad but true. Yep. Alright, Jason.
We could talk for
going on forever. Yeah. Absolutely. And and again,
again, we'll have to find sometime time to
do it over beer or someday. But Yeah.
Okay.
1 last question before we go, And this
is a softball. What what other their if
what other stuff can we find at Intel
tech. I know he, he wrote the book
called extreme privacy.
There are now Pdfs that you can subscribe
to you which I have done that you
could for different platforms. Nick and it says
extreme, but I assume that you you could
learn a lot for them. You'd if you're
not going full tilt Michael Basil.
Yeah. So for the extreme privacy book, it
really is extreme. It's not most people. There's
probably about a third that is basics, and
then in a third that's intermediate and the
third that is crazy, like, becoming a digital
no and wandering the lands.
So that is probably on the scope of
most people, but now we also have these
smaller digital guidance. So when you go to
a site,
what most people are just going to need
and want is the free stuff. So if
you go into our resources tab in our
tools tab, all the free stuff I... Talked
about is there. So go take all of
our free stuff. No pressure to get anything
else. But if you decide you wanna take
it to the next level, we have guides
on firewalls
and We have guides on privacy. We have
guides on building out your own privacy based
phone. Right? Mh. So there's all sorts of
stuff. Then on my side of the house,
we have online training for open source intelligence.
I train at Black hat every year. We
do private events. We do keynote, privacy... Security,
we do all sorts of consulting. So
we have a lot of different roles there.
And... But mostly in the privacy security or
Open source intelligence
fields.
Wonderful. Well I'll put links to the show
notes, as I said, Jason, thank you so
much for coming the show. That we'll definitely
have to bring you back in the future.
Absolutely. Thanks, Kurt.
I really enjoyed that to interview did too.
That was a lot of fun, very, very
interesting
and
brought out a lot of things that I
don't think a lot of us think about.
So just Fyi, I've been going through their
data removal guide. And, there are links in
the shown notes. You're welcome to, obviously, go
look at that yourself, as well as links
to many of the other tools and,
and stuff that we talked about today, all
today show notes. But I am going through
the process of,
requesting that my data be deleted or in
some cases
suppressed, and I'll explain that when the time
comes. Using the documents that these guys have
put out, which are very, very helpful. I'm
taking a whole bunch of notes that I'm
going to be talking about that, I might
even make that like, a whole episode, because
it's a... I'm just shocked at the...
The things that I'm finding and the weird
aspects to how all of these things work.
It will be a tip of the week
for sure, but it's gonna be a big
1. So we'll see End I might have
having to dedicate a whole kinda episode to
this. We will see.
But know that that is coming. So you're
welcome to look at it now, but if
you want me to kind of blaze the
trail for you,
stay tuned because I will be giving you
my experiences on this and and give you
some tips and tricks for things that I
found along the way that may help you
out. If and when, you decide to do
this for yourself. And I think you should,
by the way,
if for as kind of painful and weird
as this process has been,
it was very enlighten, and I I... After
having done it, I will agree with Jason
that it it's something you shouldn't pay someone
else to do. You should do it yourself
and paste yourself and spread it out every
time. So, anyway, I will give you my
take on that and maybe my advice on
how to go about doing that and a...
Future show, not too long from now.
Patrons on Thursday we'll get some really fun
bonus content with with Jason.
I ask him
So How do pronounce Michael Be or basil.
How do you pronounce that last name? And
his answer was
surprising and
hilarious.
We also talk about using
disinformation to mask your own data,
throwing out some of that cha. The sm
interesting takes on that.
You will find out why you actually are
more likely to have your information exposed by
4 request than your elected officials. And then
I had to ask him, you know, since
they take care of some of these high
profile clients. When you go through the looking
glass 1? What does it like when you
try to take, you know, the stream measures
to to scrub people's information
from the Internet. So all very interesting stuff,
and that will be coming for the patrons
as usual, on the Thursday bonus podcast.
Next week, we'll have a new show. Again,
I will definitely cover the the cloud strike,
debacle,
And maybe I'll be ready to talk about
the data deletion project that I'm on, but
I've not next week, it will be sent.
That'll do it this week. Take care of
everybody stay safe out there.
And until next week as always,
don't get caught with your draw down.