OSINT: Remediation

[This is Part 2 in a series – be sure to read Part 1 first, then Part 3]

Now that we’ve done our initial research to see who has our data and what juicy data they have, it’s time to try to delete what we can.

Why You Should Do This Yourself

Before we get into this, I’m sure many of you are thinking: can’t I just pay some company to do all of this for me? Yes, you can. But there are several reasons I think you should do this yourself. First, ironically, you’re going to have to give the data deletion company a ton of your most personal information. Now there’s one more company who could abuse or lose your data. Second, these companies are going to do exactly what I’m going to tell you to do, but it will be automated and mindless. You will be more motivated to do a good job, especially if there are any hiccups in the process. Finally, this is unfortunately not a one-time exercise – you’re going to have to do periodic spot checks, and probably repeat the process. That’s why most of the data deletion services are subscriptions.

Deleting your data is not as easy as it should be or as it could be. These sites make money off your data and they don’t want you to delete or restrict access to it. So let me walk you through the deletion process, based on what I found.

What to Expect

These data devourers will use lots of dark patterns to distract, dissuade and discourage you. They’ll warn you that all of this is just public data anyway, so trying to delete it is futile. They’ll also tell you that it may all come back again in the future, anyway, so why bother? LexisNexis even said:

“Please understand that by opting out, you may experience future difficulty using online systems for such things as instant identity and insurance verification.

These tactics are just trying to sow fear, uncertainty, and doubt (aka FUD). These sites will make you jump through lots of hoops, with warnings along the way, all trying to make you give up. Be ready for this. Personally, every time they tried to derail the process, it just made me more committed to completing it.

Second, privacy laws are a mess. Your privacy rights around data deletion will vary depending on what country and even what state you live in. Do what you can. Similarly, some sites will tell you that there is some data they can’t delete, but they can restrict access to it or ‘suppress’ it. So just do whatever you can here. This is why we need privacy laws.

My Data Broker Report

I requested my Acxiom report and received it by email about two weeks later. The report was 102 pages long and contained names (variations with my middle name, suffixes, and even common misspellings), past addresses, phone numbers (including one that I thought was private), Abilitec identifiers and other obfuscated IDs (which I’m still investigating), IP addresses (?!?), ages (yeah, plural… some were close but wrong), ethnicity, religion (including “assimilation level”), estimated number of kids, salary, detailed info on buying activity and interests, cars I own, loans I’ve had, estimated alcohol usage, likelihood of having a healthy diet, body mass index guesses, estimates of my interest in health and drug products, and much more. It was mind-blowing. (The format was hard to read as a human, it was meant for computers.)

One really odd part of this report… there was a crap ton of estimates regarding my interest in specific car models. About 75% of the total pages were devoted to this.

One key note at the very end, under “data disclosed”… it said:

Acxiom does not process sensitive personal information on residents of the Commonwealth of Virginia, Colorado, Connecticut, Texas, Oregon, or Montana.

Lucky them.

Note that Acxiom uses this weird dashboard thing… you have to save the link to it, then give them your email address (and pass a CAPTCHA), and they will then email you a one-time access code to log in (that is, there are no passwords).

(I had trouble requesting my data from LexisNexis – I need to call them, and haven’t had time yet. But I’m sure their report on me would be equally long and disturbing.)

Deleting Broker Data

Let’s start with the big ones first: the data brokers, Acxiom and LexisNexis.

Acxiom’s opt out page is deceptively simple looking. The little form requires you to enter multiple things, and then click a plus sign to add it to your request. You’re going to want to add mailing addresses, email addresses and phone numbers. And here’s why you should request your profile first: you should only enter the ones they already have.

Then give them an email address to use for you (either one they already have or an email alias). They’ll send you an email with a link to click (to make sure the email address you gave them is real and controlled by you). Click that and formally submit your request online. You’ll get a confirmation and a reference number – jot that down.

LexisNexis is a little simpler. They’ll ask you why you’re doing this. I said “I do not want my information shared”. Then they ask for your name and Social Security Number. Sigh. I can’t recall if I tried to submit without the SSN, but you can try it. However, they probably already have it. Then they ask for a phone number and email address. They have a pull-down menu for where to send your report via snail mail (they already have that info). That’s it. You’ll get a confirmation email with a reference ID. Save that off somewhere safe.

LexisNexis also has a “security freeze” option that’s similar to a credit freeze. You request it here. However, for some reason, they require you to upload a copy of a government ID to do this. I’m going to pass on this one, though I’m going to ask them about bypassing this requirement when I call about my data report.

Delete People Search Data

I’m not going to go through all eight of the people search sites in Intel Technique’s list (BeenVerified, Infotracer, Intelius, Mylife, Radaris, Spokeo, TruePeopleSearch, Whitepages). I will note that they each had different amounts of info on me – some had a scary amount (like Radaris), some had some basic info, and a few actually had no records that matched me. My guess is you’ll find some mix of this yourself.

But here are the key things to keep in mind as you request each one to remove your data:

• Don’t give them any more info than necessary, particularly info they don’t already have (based on your initial research). Each site has different methods for verifying your identity (can’t let just anyone try to delete precious data). Some are weird (Whitepages called me to exchange a PIN code).
  • Many will ask you innocent questions like “is this you?” or “can you share more info to narrow down your results”? Resist the urge. Select “I don’t know” or skip the question.
• Give them an email alias for communication or use an email address they already have for you.
  • If you can, use an email filter or “rule” to automatically move all related emails to a special folder, to keep it all organized.
• Take good notes on what you find – so you can verify later when that info is gone and if it comes back. (See my original article for ideas on how to organize everything.
• Create a to-do list for following up:
  • If they give you a timeline for when to expect them to process your request, note that down and check back then. If your info is still there, you’ll have to follow up and complain.
  • Create reminders to check again in 6-12 months. If you find the data has returned, again you’ll have to follow up and complain.
  • After the first re-check, I would check again in 6 months if the data returned and maybe 12 months if not.

Deleting Face Data

I added this section after reading this article from 404 Media about using smart glasses to look people up on the internet. (And of course, this is related to Clearview AI – check my interview with the NY Times’ Kashmir Hill.) These sites offer image searches for human faces. You might try searching for a picture of yourself. And you also might ask these sites for a copy of your data before you delete it.

• Pimeyes
• Facecheck ID

Next Step: Help Others

Now that you’ve gone through all of this effort to protect your own personal data, you should think seriously about helping others to do it, too. Certainly consider your immediate family (kids, spouse, parents, siblings) because a) it’s a caring, helpful thing to do, and b) more than likely their data broker reports point to you, too.

I actually added a third part to this series, after learning about some new options that might be easier. See Part 3.