OSINT: Final Steps

[This is Part 3 in a series – see also Part 1 and Part 2]

In the first article in this series, we discussed how to search for your personal information held by data brokers and offered up by people search sites. In the follow-up article, I gave you instructions on how you can request that these sites delete (or at least suppress) your data. I have just a few more thoughts and tips that I need to impart.

New Info from Trusted Sources

Much of the advice I gave in those first two articles came from the wonderful Intel Techniques data removal workbook (along with my interview of OSINT expert Jason Edison). However, since I wrote those articles, Consumer Reports published a helpful report on the effectiveness of data removal services like DeleteMe, Optery and several others. Also, my friends over at Privacy Guides and Techlore reported some of their own findings when reviewing this report.

I encourage you to read the entire report from CR, but here’s the TL;DR. First, they found that the most effective means of removing your data is to go through the process manually, as I (and Jason) suggested. In their limited study of 32 volunteer test subjects, they found that the manual process had the most success (70% of profiles removed) and worked the fastest (within a week). However, they acknowledged that the process was painful. A couple of the paid services came close (Optery at 68% and EasyOptOuts at 65%) but the removal process took up to four months and cost money (in the case of Optery, it was $250/year).

In this video, Henry (Techlore) and Jonah (Privacy Guides) discussed their experiences with these services and gave their own advice based on the CR report and their personal experiences. And after all of this input from trusted sources and some more research on my part, I’m going to amend my recommendations a bit.

Additional Research

I’ve learned about a few more useful tools for discovering information about yourself on the internet – all free (or with a free “lite” version). Of course, like any other such site, you’re going to have to (rather ironically) provide them with some personal information in order to search.

While I can’t recommend paying $250 (annually) for Optery’s data removal service, they have a free tool that will search for your information at almost 600 data broker sites (which includes people search sites). This search will not only show you many sites that have profiles, but will helpfully link you to the proper site to request removal. The search takes some time (an hour or two), but it’s free and I think it’s worth trying. You can download a PDF of the results.

Also, Consumer Reports now has their own data removal tool called Permission Slip which you might try out. There’s a free and paid “Pro” version. I conducted a podcast interview on this topic with someone from Consumer Reports which you might want to check out

You should also have a look at the extensive Bad Ass Data Broker Opt Out List (BADBOOL) maintained by the wonderful Yael Grauer. (I actually interviewed her about Permission Slip and data brokers.) It’s not just a list, it also has a lot of very useful information about opting out. Some states like California and Vermont maintain lists of data brokers by requiring them to register. There’s also this killer spreadsheet that lists the top data removal services and which data brokers they do (and don’t) cover.

I was also reminded about a tool from Google called Results About You. You can enter up to three names, three mailing addresses, three phone numbers and three email addresses. This report also takes some time to complete (hours). Once done, you can ask Google to remove these search results. This will have no effect on the original sources of this information, but it will at least (supposedly) stop Google from providing this information in its search results. You can also ask Google to notify you if this information pops up again, and then ask it again to remove it from its search results.

One final interesting tidbit I learned this week. According to a tweet from someone who researched the massive National Public Data breach, “The database DOES NOT contain information from individuals who use data opt-out services. Every person who used some sort of data opt-out service was not present.” So, this data deletion exercise has benefits you might not realize.

My Amended Recommendations

In the first article of this series, I recommended that you research your own data – see what’s out there first. I pointed you to two top data brokers and eight top people data search engines. The purpose of this is two-fold:

1. See for yourself how much personal information is available about you right now.
2. Know what info each site has on you, so that when you ask them to delete your data, you don’t inadvertently give them more.

In the second article, I walked you through the process of requesting that each of these sites delete your data. I proposed some tools and techniques for keeping track of your progress, told you what to expect, and gave you a plan for following up periodically – because many of these sites will simply repopulate your profiles from new data in the future.

Given the new information above, I want to amend this slightly. I still recommend that you search for yourself first, at least at the top sites that I listed. I think it’s important to see it first hand. However, you could consider using the free version of the Optery tool for this. (UPDATE: Optery briefly planned to send your data to OpenAI, but backed out after a deserved backlash.)

I also still believe that the most effective method for removing your data is to do so yourself by visiting each of these sites using the links in the Intel Techniques workbook. The CR report backs this up. Jason Edison, an OSINT and privacy guru, suggests this, as well. And it’s definitely the cheapest method, being free. However, if you can’t bring yourself to do this (and you live in the US), then I think using EasyOptOuts is your second best option – or you could even do both. Their tool is almost as good, will cover more sites, has a simple and helpful privacy policy, and only costs $20/year. (Be sure to read their FAQ, too.) I’m going to try them myself and update this article at a later date.