Internet privacy: It’s not just Mark Zuckerberg’s responsibility anymore!

It astounds me to see how many people rant and rave about Facebook privacy settings while neglecting to realize how easily they can be tracked down online using information they freely give out around the web. I was reminded of this after reading a post the other day from George over at Arm Your Mind for Liberty, where he gives some advice for engaging in activism that may be less than legal.

You’re probably wondering why I posted a screencap in the beginning of this entry. This is an edited screenshot of a guy who popped on my blog the other week, “Val.”

Because I’m a curious type, I wondered how “Val” had found my blog. I couldn’t find any direct links (no obvious Google search), so I decided to invest no more than ten minutes (literally!) into seeing what I could find.  Hey, I don’t know. Maybe he got way too angry with something I said on a blog or on a mutual Facebook friend’s wall. Again, curiosity killed the cat.

If you’ve ever read any Wikisposure entries, my methodology probably looks a little similar. That’s because it’s pretty much the same procedure. You’d be amazed at how much info people willingly disclose on the intertubes. (Then again, if you’ve ever read Wikisposure, you probably realize that and are much more guarded with your personal info than most people are.)

Step one: IP search

My first stop was to do an IP search on the comment.  While IP searches are not as reliable as every dope on the internet seems to think they are (and haven’t been for years), they still give you a good idea of the general area where the person posted from.  (Oh, and before you say it: Yes, I am aware of proxies, but given that most folks don’t use them and I have yet to draw the ire of Anonymous, I assume that anyone posting to my blog is likely using an honest IP.)  Not only can they give you an idea of location, they can also tell you ISP info.  For example, during various times I have experienced harassment from real-life former friends, I can tell you that I have received comments from a Verizon cell phone as well as from Blackberry users.  While this isn’t concrete info that definitely singles out one person, if you know someone who IRL or e-hates you who also just purchased a Blackberry Storm, it isn’t too difficult to start ruling folks out.

Additionally, WordPress gives me a nice little feature where I can search and filter IP addresses based on whether or not a user from the address has commented here before.  This little feature is handy if you’ve experienced harassment and the person in question has left you comments that confirm their identity at any point in time.

He had never commented to me previously, but an IP search turned up an ISP location outside of Houston, TX.

Step two: Facebook search

Once I had that location semi-confirmed, I then dropped his email address into Facebook.  Luckily for me, I found a Facebook page.  Although we have no mutual friends or other connections to one another, he was naive enough to link the same email he used in the comment to his Facebook profile which he also linked to his real name.  This profile also had him listed in the “Houston, TX” network.

Now I had his location, full name, and photo confirmation of his identity.

Step three: Googling his email address

I began Googling his email address as well as using the first portion of his address.  (i.e., instead of “drunkenatheist@gmail.com,” I’d try “drunkenatheist”)

Why do it both ways?

Well, an email address might not turn anything up, but many people online are creatures of habit. They select one username that they think is awesomeschmaltz and use it on every single website they encounter. (I’m guilty of this.) Sometimes, the email might not turn anything up, but you can find forums they participate on, other social networking accounts, a personal website, etc.

His email mainly turned up worthless crap; however, a search for just the first portion turned up a few forum posts on a parenting site (between location confirmation and some info in the posts, I feel confident saying that the posts were likely made by him or his partner), and a Youtube account (which I was able to confirm between his interests and his photo).  Additionally, using his full name as provided on Facebook along with his state turned up a list of federal assistance recipients (which is not confirmed past name and state, so your guess is as good as mine) as well as a likely address (the name and town matched).

Three little steps turned up multiple online accounts, a full name, a location, a possible address, personal family information, and a face to put with the name.

I was able to get all that info when all I started with was a nickname, email address, and IP. (And let’s be honest, the IP wasn’t the most useful portion of that.)

When I had my run-in with an exceptionally shitty “Christian” named “Craig” on the Phillyfreecycle list, I was able to easily locate his address with information he had provided.  I searched using his phone number (which he provided freely to the list) and was able to corroborate the results with his name and the general location he had provided on Freecycle.

This isn’t a guide to stalking, but if I could turn up all of this information about someone I don’t know using minor information, think about how easy it is for someone who knows/knew you to pull up info on you?

Before complaining about this or that website’s privacy terms, it’s a much smarter idea to think about how much information you make available on the internet.  Now, I don’t care so much because I’m generally pretty cautious.  If it’s out there, it’s usually because I feel comfortable putting it out there.  I’m also very lucky. “Vicki Moore” turns up an awful lot of people.  When I first moved into PA, it turned up 3 or 4 neighbors in my small town.

At the same time, I’m not going to give people a road map to linking up my internet activity with my real life activity.  If you have legitimate concerns about being “found” online, do the following:

1. Don’t link your real email address to Web 2.0 sites like Facebook. Set up a throwaway email address for correspondence on Facebook, Twitter, etc. If you track down people you know IRL, you can message them your real email address.
2. Don’t give out your phone number.
3. Keep neighborhood and city information as vague as possible. Instead of telling someone “oh, I live in the Italian Market” or “I live at 9th and Washington,” limit it to “I live in South Philly” or “I live in Philadelphia.”
4. For the love of all that is unholy, quit using websites like Foursquare. You might as well scream “PLEASE STALK ME NOW, KTHX!” Similarly, watch how much you disclose on Facebook or Twitter, especially if you add a lot of people that you don’t personally know. You might want to plug an event at a local bar, but you really don’t know if every person on your friends/followers list has good intentions.
5. Change up your usernames, especially if you’re participating in forums you wouldn’t want your family or coworkers to know about. One trick I’ve employed in the past is to find a random object or phrase and make it your username. If you’re trying to avoid people you know personally, avoid any sort of numbers or words with personal significance to you as well as zip codes, area codes, etc. If your first pet’s name was “Bucky” and you started dating your boyfriend in 2008, “Bucky2008″ might be a bad choice.
6. Try to keep from getting arrested. Look, I’m not saying that it’s necessarily avoidable. There’s plenty of good examples of people getting screwed over by THE MAN. But take simple tips. For example, if you’ve had a few beers, either stop drinking a few hours before you want to leave a bar/party or call a cab, walk, take public transit, etc. Arrest records – which are available either through docket searches or crime log reports in the local newspaper – are typically considered public record. (I say “typically” because clearly there are exceptions to this and though I assume that the arrest of an adult is public record in every state, I don’t know for certain.) You know what they usually include? Your age and the town you currently reside in; what a great tool for confirming an identity.
7. I’ve touched on this above, but one of the biggest things you can do is control the information you put out there about yourself and your loved ones. Come up with nicknames or pseudonyms for the important people in your life. Anarchist Boyfriend has commented on my blog using his real first name. If he chooses to disclose his name, that’s his deal. I prefer to use the pseudonym. I received a comment from a former friend. She left her full name and an idea of location (as well as an email, IIRC). You know what? I still get blog views from people Googling “first name last name” + “philadelphia.”

The intent of this post isn’t to freak you out, and again, it’s not meant as a guide to stalking. Rather, I’m trying to show just how easy it is to find you online. I’m hoping that maybe someone will read this, take some of my advice, or possibly just store this post in the back of their brain.

• «Previous Post
• Next Post »

---