The internet has really blown apart personal privacy. This can be a problem for everyone, but even more so for law enforcement personnel. Police officers tend to have a lengthy list of adversaries to avoid while trying to carry on a normal life. Even before social media sites, it was becoming very easy to dig up information on people just from basic searches. It’s easy to control the information that you post online about yourself, but it’s much harder to control the information that other people post about you.
Newspapers and community associations frequently post well-meaning stories and events and in doing so can easily disclose the precise area where someone lives or works. Associations with religious groups, or other, possibly controversial groups, can sometimes be found online. The collection of these small, seemingly innocuous pieces of information can create a trail whereby an adversary can compile a fairly complete dossier on you. This article contains information and practical steps you can take to protect yourself online.
The lay of the land
Understand that social media cannot be trusted to keep any of your information private. Some sites, such as Facebook, have lengthy and complex privacy controls which can lead to a sense of security. But keep in mind that every social network makes money by selling or using your personal information. Facebook has a long, long history of breaching privacy laws so there’s no real confidence that it won’t do it again.
Other social media sites such as Twitter and Instagram are different beasts. They are much less complex and therefore have a lesser ability to store information on users. Conversely, they’re also almost completely public. Other than specifically locking down your Twitter or Instagram account, there is no way to stop all of your posts from being available to the general public. These sites have an “all or nothing” privacy setting.
Social media is a particular concern because of the mass of information that people tend to share. However, that doesn’t mean the regular old internet isn’t a problem as well. If you were looking for someone who you knew lived in Nova Scotia, you may find them on this list from the Run Nova Scotia website. From that, you would know where they’re going to be in a few days (as of the writing of this post). Want to find out who is in the International Astronomical Union? No problem. Curious about someone’s religious views? That can be out there, too. Local newspapers are also a good source of information; it’s not hard to pick out a few residents of the area where this town zoning dispute took place. All of this type of information represents privacy data that was posted by third parties about these people. Unless you live under a rock, there is likely information about you on the internet that adversaries might be able to use.
In some cases, a stalking can begin during the routine execution of a police officer’s duties, but then grow into a very large problem. This individual became so enraged at being stopped for a traffic violation that he allegedly organized a Facebook page encouraging people to booby-trap their property and then film cops being caught in the traps.
General tips
Since it is not really possible to predict every situation that can result in your information being posted online, it pays to be a little paranoid all the time. With a little forward thinking you may be able to use some of these ideas to make yourself a little harder to find online.
Try to be proactive. It may be too late if there is already lots of information about you on the internet already, but at least try to stem the tide and avoid situations that will obviously end up on the internet. Any event that is interesting or well attended has the ability to attract journalists and cause people to whip out their phones to record video. If you’re extremely paranoid, you may want to purchase clothing that causes flash photography to fail.
Obfuscate your name to avoid casual researchers. A quick and easy obfuscation that technically isn’t a fake name is to use your middle name as your surname. For example; John Dave Doe becomes John Dave. Your middle name is generally not as well known as your surname and even if it were, you’ve essentially made it twice as hard to find you.
If your name is very unique then you have a bit of a problem. For example, it’s not too hard for Jon Watson to disappear in the masses of Jon Watsons, but it’s harder for Siobhan Von Flowerpetal to do so.
Don’t give blanket approval for an organization to publish your name or image. When joining organizations, inform them that you don’t consent to having your name published anywhere without prior approval.
Assess the potential damage. If you’re at an event or a meeting where pictures are being taken or names are being recorded, determine the likely outcome if that is published. For example, a town meeting on the zoning of a particular property is a pretty good indicator that you live very close to that property. On the other hand, an ad-hoc gathering in the next city over to attend a racing event is less intrusive. If the situation warrants it, ask that your name and picture not be used.
Know what will be shared. Social media sites and other account-based sites generally have a privacy policy. Read this to determine how your information will be published to the public. For example, there is no way to hide your Facebook name and current profile picture from the general public.
Use a non-identifying profile picture. If you’re a police officer, using a badge as your profile picture is going to help confirm your identity. Likewise, using images that are personally connected to you such as your pet or your car may also identify you. Even generic profile pictures can give clues to your likes. Unless there is some very compelling reason for your public profile picture to be linked to you, choose something generic or deliberately misleading. Use your neighbour’s dog.
Assume your information will become public. This may seem like a negative attitude but it is reality. No matter how elaborate the privacy settings of a site are, there’s absolutely nothing stopping your “friends” from taking a screenshot of your information and doing whatever they want with it.
Pay attention to the information your friends and family share. Seemingly innocuous things that spouses and friends can drop may provide information about you. A good example is are police spouse associations. in which membership strongly indicates the spouse is a police officer.
Social media tips
When considering your presence on social media, the first thing to determine is if you need to be there at all. Social media sites don’t cost any money to use, yet some reap billions in profit each year. How does a company that does not charge money make any money at all? The answer to that is they do charge money; they just don’t charge you.
There’s a saying “if you’re not paying for the product then you are the product” and nowhere is this more true than social media. Marketers have been trying to figure out what people want for decades and an entire field called “market research” has been created to service this need. Things like loyalty card programs aren’t about loyalty at all, they’re about collecting data from real consumers about what they buy.
Social media sites are the next iteration of data collection. We tell the social media sites what we want, where we live, how old we are, our gender, what we like, and who our friends are. Selling that data to market researchers is where social media sites make money, and they make a lot of it.
Knowing this, it only makes sense to consider social media sites as an adversary. Their sole predatory mission is to pry as much personal information out of us as possible, which is usually diametrically opposed to what privacy conscious people want.
It’s technically not possible to obfuscate your real name and still comply with Facebook’s policy on account names. Facebook requires that your name be the name that your friends call you in “everyday life”. I’m aware of many people who use their middle name as their surname on Facebook which is a mild obfuscation but works fairly well, although it is technically not allowed.
Try not to use Facebook for anything critical that you can’t afford to lose. The reasoning behind this is Facebook’s stringent lock out rules. If you’ve been locked out of your account for some reason, you’ll likely have to send in your real life ID to Facebook to get unlocked. The list of acceptable ID documents include things like your passport, driver’s license, or marriage certificate. Although there is an option to send in two pieces of lesser ID such as a bank statement or a library card, do you really want Facebook to have anything at all like that? It seems better to just kiss that data goodbye and create a new account.
Be aware that your group memberships are not very private. Facebook users who are not members of a group can still see some of the members of that group. In some cases, the posts are public and therefore the authors’ names are visible. In other groups, the member list is visible to non-members. If you’ve joined law enforcement related groups, it’s possible to be found that way.
Twitter doesn’t seem to care what name you pick. Its naming policy dictates some technical limitations on how usernames are to be constructed, but no policy on what a username should reflect. That makes sense because Twitter is essentially public so it behooves Twitter to allow more username obfuscation to protect privacy.
Twitter accounts can be protected. This means that your tweets can’t be seen by the general public. But, everything else can. Your username, profile pic, location, joined date, and your profile description are still publicly available. In order for someone to see your tweets, they have to ask for permission to follow you which you will need to approve. At any later date, you can revoke that permission.
Like Twitter, Instagram doesn’t seem to care how you choose your username. The Instagram help documents indicate that there is a way to protect your account so that other users have to request permission to see your feed.
In the Instagram app (not a web browser), click the profile button (head and shoulders icon), then the three dots in the top right corner to open the Options menu. Scroll down to account, and toggle the switch for “Private Account” to the on position.
Tips for other websites
Your name can crop up anywhere and sometimes it can be associated with personal information such as your address. If you’ve ever spoken at a town meeting, you may find your name in the local paper. If the subject you spoke about was local in nature, for example an issue on a particular street, that makes it pretty easy for people to find out where you live. Things like membership lists, political affiliations, and court cases are published regularly on the internet and provide a rich environment for determined adversaries to find you.
Where possible, decline to give your name. If that is not possible, there may be ways to obfuscate it such as using your maiden name, if that applies to you, or using initials only. If you find your name online in a manner in which you don’t like, contact the site owner and ask for it to be removed. If you explain your reasoning, and there’s no particular reason why your name must be published as-is, you may find that the site owner is willing to do that.
Another concern is Google. Google’s primary product is advertising, not search. Google search only exists to collect very targeted data about what people are looking for so that Google’s main business, advertising, can place relevant ads in front of them. The Google search engine is just a very sophisticated tool that exists almost solely to get us to tell Google what we are looking for so that Google can advertise to us. The more precise that data, the better it is, and Google has very sophisticated algorithms to further inspect your activity. If you have a Google account and are logged in to it when you search, Google can collect even more data about you which can subsequently be used or sold. It’s at least theoretically possible to delete your entire Google history, and the Web 2.0 Suicide Machine can help with some other sites.
Account separation
If you need or want to have an online presence in your field, you can create specific accounts for work which are unrelated to your personal life. For example, work laptops don’t necessarily have to be logged in to your personal Apple account or Google account; you can create specific accounts for work and use those instead. Likewise, social media accounts can usually be created for organizations or individuals for a specific purpose.
If you have a specific area of expertise, such as neighbourhood watch coordination, you can start a social media account for just that purpose. Maintaining a separate work-related account is a little more work but it can help disassociate your person from your craft and still allow you to provide information in your area of expertise. Instead of being Sgt. John Smith, you can create an organization page for your neighbourhood watch and post as that name instead of your own.
After the fact
If you’ve discovered information online about you that you’d like removed, it may be possible. There is a school of thought that states once something is on the internet, it is on the internet forever but that is simply not true. Ask anyone who does internet research for a living and they’ll tell you that the internet is rife with dead links and missing content. Certainly, if a piece of content goes “viral” then it ends up being copied all over the internet and that can be hard to remove, but that doesn’t describe most internet data. It’s very possible to remove data from the internet if it exists on just one or two sites. Contacting the site owner is a good place to start. Many sites will have a contact page but if you’re unable to find that, running a whois lookup on the domain name may provide contact information. It’s become commonplace to hide domain registration information using privacy services so you may not have any luck with a whois.
If the content can’t be removed, the next best thing is to have it de-indexed from the internet search engines. The internet is a big place so if a piece of content isn’t indexed on a search engine, it becomes extremely hard to find which is almost as good as it being removed altogether. Of the search engines, Google is the most important. There are guidelines as to what type of content Google will remove here.. In general, Google seems to take the stance that it just indexes the information and isn’t responsible for the information itself. Some jurisdictions disagree with this stance and the state of Google’s willingness to remove information will probably always be in a state of flux. At the time of this writing Google will remove indexes for things like:
- Digital Millennium Copyright Act (DMCA) complaints
Illegal images - Personally Identifying Information such as government issued identification
- Financial information such as credit card and bank account numbers
Removal cases are usually handled on a case-by-case basis.
Keep in mind that although the other search engines are much less used, that actually makes them more valuable. Researchers know that people usually only focus on Google when de-indexing content which means content that doesn’t show up on Google may still be indexed on other search engines like Bing or Yahoo. If you’re going to ask for your information to be de-indexed, ask for it to be removed from every search engine that has the content indexed.
Another tactic is to overwrite existing content with new information, rather than trying to remove it altogether. The theory here is that search engines are geared to index the most current data on a site and edited content will be indexed faster than it takes for removed content to be deleted from the index. You may be able to convince the site owner to remove just a portion of the content, or provide updated information that is less identifying to put into the article. Some search engines retain caches of older documents so this efficacy of this tactic can be hard to determine.
The pervasiveness of the internet is part of normal everyday life at this point. It’s not possible to control what other people may post about you, so the next best thing is to be as proactive as possible. Simply ignoring the internet or social media isn’t a good tactic; if you don’t maintain a seat at the table then you have no chance of controlling the conversation.