OSINT: Reconnaissance

[This is Part 1 in a series – see also Part 2 and Part 3]

There are thousands of data brokers who are collecting, collating, correlating and packaging up your personal information, and selling it to pretty much anyone who will pay. Much of this information is available to anyone, if you know where to look, and is broadly referred to as Open Source Intelligence, or OSINT. Today I’ll help you figure out how much of your information they have. In the next part, I’ll help you delete what you can.

[I recently had a fascinating interview with Jason Edison, an expert on OSINT from Intel Techniques. Jason has a very unique perspective, playing offense for his day job working with law enforcement and helping others play defense with his partner, Michael Bazzell, author of the book Extreme Privacy. The podcast is well worth a listen, but I’ll tell you what you need to know here.]

What is OSINT?

Open Source Intelligence (OSINT) is a broad category of personal information that can be obtained from public sources. In the old days, this would be paper files you could obtain by filing the proper forms at proper county or municipal office, maybe paying a small processing fee. This often had to be done in person, during business hours. Today, in the spirit of transparency and efficiency, much of this information can be obtained via government websites for free.

Other sources of OSINT include newspaper articles, corporate filings, court records and legal filings, professional and sports license databases, voting records, property tax records, and (of course) public social media posts. You might be surprised to know that your local government agencies like DMV or state’s voter registration agency even sometimes sell your data.

The bottom line is that there’s a shocking amount of very personal info available online right now, including your full name, date of birth, home address, phone number, party affiliation, voting record, property value, and much more. Data brokers are hoovering up that data, assembling it into detailed dossiers on each of us, and selling it. And this information can be used against you (or those around you) for identity theft, scams, phishing, extortion and even stalking.

Scoping Your Data Problem

Before you can solve any problem, you first need to understand it. In this article, I’ll help you figure out what personal information is out there and who has it. You’re going to want to take good notes, which will be crucial for the next step in this process: requesting that your data be deleted (or at least suppressed) where possible.

We’ll start with two of the biggest offenders: data brokers and people search sites. For the data brokers, we’re going to request that they send us a copy of all the data they have on us. Note that, ironically, you’re going to have to provide a good bit of personal information to the data broker sites in order to prove that you are who you say you are in order to get access to your data. Give them as little as you can. Also note that your rights to request this data will vary depending on where you live (thanks to privacy laws or lack thereof).

Before You Start

Some quick important notes before you start:

• Do not do your research on a company or public computer – do this only on a computer that you own. I would also only do this on your home network or using a VPN.
• I used an email alias whenever I was required to give one. I created a special folder in my email client for these emails and set up a rule to automatically route the emails there.
• Several of the company links were blocked by my privacy filters… because yeah, they’re usually sites we don’t want to load. I had to disable my filters temporarily to work around this.
• These sites are often frustrating and are chock full of dark patterns. They will make click through multiple windows with goofy (fake) progress bars. They have scary warnings about not using the data for hiring or issuing credit (to avoid complying with the Fair Credit Reporting Act). They tease you with (usually non-existent) criminal and possible “adult content”. And the people search sites will lead you along and then try to get you to sign up for an account and pay them money. Don’t.

The Research Process

Here’s how I recommend you do your research (based on the wonderful Data Removal Guide at Intel Techniques). I wouldn’t do all of this at one time – do a site or two at a time. Slow and steady wins the race!

1. Start by downloading this workbook from Intel Techniques. Read their instructions on the first couple pages for background.
2. Their workbook contains over a hundred sites, but we’re going to focus on the top 10 sites they identified.
   • Data brokers: Acxiom, LexisNexis
   • People search sites: BeenVerified, Infotracer, Intelius, Mylife, Radaris, Spokeo, TruePeopleSearch, Whitepages
3. I created a journal for my research. My notes were all digital (I used Proton Drive and the new Proton Docs app). You can do this on paper by hand, if you wish, but I think digital is a lot easier. Just make sure your files are kept private and protected. Here’s specifically what I did:
   • Created a folder for all of these files called “OSINT”. I also created a top-level document where I took notes about the overall process, including a global “to-do” list.
   • Created a document per site, using the site name as the file name.
   • Copied the information for each site from the workbook (“Service” through “Notes”) to the top of each file, making sure the links were clickable.
   • Under that, I created a Heading-level entry with today’s date.
   • Under that heading, I took notes of everything I found and what actions I took on that site, in chronological order.
4. Visit each site, using the links provided by the workbook.
   • For data brokers, find the link that allows you to request a copy of your data. Fill out the necessary information (giving only what’s required) and file your request. In my experience, you have to wait for them to collect the data first – it wasn’t something you could immediately download, like a credit report. You may have to go through several hoops to verify your identity.
   • For people search sites, search for your name. If you have a common name, give them your home state/region to narrow the results. (NOTE: You don’t have to tell them that you’re searching for yourself.) If you find an entry (and you might find more than one), click on it and copy the web address (URL) for that entry into your notes. This is how you will check later to see if it’s gone. Also, you may need to provide this link in your deletion request.
   • As you go through these sites, takes notes on all the information they have about you, even if it’s partially blurred or redacted. My guess is that you will be surprised. For example, some sites I visited had every single past home address for me, including college apartments.
5. BONUS: I actually took screenshots of what I found on each site and pasted the images into my file. It was much easier than writing it all down, and it was also better for jogging my memory when I reviewed my notes. (For help taking screenshots: Mac or PC.) Sometimes taking screenshots of a long web page is painful. If you have one long web page with lots of important information on it, you can also consider saving the page as HTML. The browser plugin SingleFile is great for that.

You can see a sample notes file here, just to give you a better idea of how I did it.

Extra credit: There’s another massive list of data brokers maintained on this GitHub site, too, called the Big Ass Data Broker Opt Out List.

Next: Deleting Your Data

In the next installment of this series, we’ll take what we learned here and ask the sites to delete your data. You may know that there are services that will claim to do this for you, for a fee. I’ll explain why you should do it yourself.