Weekly Review of Privacy in the News - Week ended 1/31/2014

NSA watching phone users with google maps:
http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data

Facebook app asks for permission to read your text messages:
http://www.fastcompany.com/3025589/fast-feed/why-is-facebooks-app-asking-to-read-your-text-messages

British government spying on Youtube and Facebook users worldwide.  Companies deny any knowledge of the surveillance:
http://investigations.nbcnews.com/_news/2014/01/27/22469304-snowden-docs-reveal-british-spies-snooped-on-youtube-and-facebook?lite

US government and privacy advocates reach compromise which will allow companies to publicly disclose some additional data about how much data they are forced to turn over to the government under the Foreign Intelligence Surveillance Act, pending approval by the FISA court:
http://hosted.ap.org/dynamic/stories/U/US_NSA_SURVEILLANCE_COMPANIES?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT

Rand Paul says Hillary is a big proponent of surveillance state:
http://www.nationaljournal.com/technology/rand-paul-hillary-clinton-is-a-big-proponent-of-the-surveillance-state-20140128

US looks for ways to prevent spying on its spying activities:
http://apnews.myway.com//article/20140128/DABJG0G80.html

Google+ and Candy Crush are among 'leakiest apps', leaking all sorts of personal information about you to anyone: http://www.bloomberg.com/news/2014-01-29/nsa-spying-on-apps-shows-perils-of-google-candy-crush-.html

Yahoo detected major hack attack and is asking users to reset passwords:
http://www.businessinsider.com/yahoo-hack-password-reset-2014-1

How Facebook Tracks You

Facebook is used by over a billion people around the world according to the company.  It contains people's most intimate secrets and has more personal information about more people than any other site in history.  It is a literal treasure trove (ie- money machine) for advertisers targeting certain segments of the population.  However, it is also used by people trying to find you for reasons other than friendship or advertising.  The only way to be truly private on Facebook is to not use it at all.

But if you insist on using it, there are some things you can do.  Before we get to that, let's talk a little bit about how Facebook works.  Facebook itself, or anyone who has access to your Facebook can determine a number of things about you just by your friend list.  Your friend list makes it almost impossible to maintain anonymity.  So if you think you are outsmarting everybody by not putting your hometown or your high school on your 'About Me' page, you are mistaken.

Here is an example of what is known as a social graph:

Thank you to mark-photo.com for allowing me to share this graph with my readers.

Facebook has one of these for all 1.1 billion of their users (in fact, there are apps out there, like Touchgraph, that will let you create one of your very own).  I know it looks sort of complicated, but it is very simple.  Each dot on the graph represents a person that the Facebook user knows.  Lines between two dots represent mutual friends.  Clusters of friends were labeled by the user.  The central figure in the middle is actually the Facebook user's spouse who are commonly centerpieces on these graphs as spouses often know many of the same people.  So this Facebook user is friends with a number of people from his old high school, many of whom are also friends with each other.  The three lines heading off to college represent someone from his high school that went to his college.  The line from high school to family represents someone from his family who went to his high school.  The elementary school cluster suggests that he moved to a different area or changed school systems (such as private or charter to public or vice-versa) at some point because not a single person from his elementary school knows anyone from his high school.  The six dots to the right of the high school cluster (that sort of look like a stingray) appear to be some sort of group or club from back before he was married because none of them know his wife or went to any of his schools.

So even if this Facebook user chooses not to share where he went to high school, the information is still quite obvious and is available to anyone who goes through and looks at the high school cluster profiles as undoubtedly, one or more of his friends have indicated where they went to high school on their profiles. This would reveal where he grew up.  The elementary school cluster would show where he used to live before he moved.  The same applies to his choice of college.

This is a lot of information gleaned from someone I don't even know and I don't have any access to their account.  And I'm not even an expert at this sort of thing.  Imagine the possibilities for an expert with the proper access credentials, which are quite easy to obtain by hackers or others wanting to know more about you.

Each one of us has a unique social fingerprint, and Facebook does an excellent job of bringing this information all together.  It is quite difficult to hide your fingerprint.  Perhaps you already know that Facebook collects too much information and you've tried to take measures to maintain some semblance of privacy in this part of the online world.  For example, maybe you have created a fake name on Facebook to maintain your anonymity.  This may help a tiny bit to keep casual users from identifying you, but like real life, changing your name won't change your social fingerprint and even casual users would be able to easily identify you by the people you have friended (for example Mom and Dad, brothers and sisters, aunts and uncles are all readily apparent on Facebook even if you haven't tagged them as relatives).

Perhaps you've thought REALLY hard about this and decided to friend a bunch of random people to confuse things.  Maybe you have had added many, many friends so those with access to your Facebook would have a harder time determining your personal information like where you went to high school.  But since all of your random friend requests probably do not know each other, you will still be left with the clusters seen above, along with single unconnected dots of the people you added in a futile attempt to gain some anonymity.  Here is the chart above after adding 48 random people who do not know each other or any of your other friends:

See the 48 individual dots at the bottom left?  Those are the 48 people you added to 'muddy the waters.'  As you can see, it didn't change your social fingerprint very much.  Also, Facebook monitors accounts for people friending people they don't know (ostensibly to stop spammers) and will slow your ability to make friend requests, turn off that ability for a period of time, or close your account (especially if the account is not seasoned/new).  They know that you don't know any of those 48 people and so do you, now that you know how to read a social graph.  Changing your name and adding random friends does nothing to change your social fingerprint.

The NSA's phone metadata collection program works much the same way as described above.  This is why they collect metadata information and don't really care about the content of your messages or phone calls (though they listen to calls, including calls of world leaders, and read messages regularly for no apparent reason).  They feed this information into supercomputers put it all together to build electronic dossiers on all of us.  The more datapoints they have on each of us (such as IP addresses, emails, credit card data, banking, travel, etc), the higher the quality dossier they have.  They can gather far more intelligence this way than actually listening in on your phone calls or reading your emails.

Stay tuned for Part 2 where I will discuss strategies for increasing your privacy on Facebook.

How to Remove Exif Data From Photos

Last week, I wrote about how to remove the exif information your digital camera or smartphone attaches to your photographs. Exif, which stands for exchangeable image file format, is a standard that specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras. Exif data contains a number of metadata tags about the photo such as the date and time it was taken, make and model of the camera, various camera settings and other information including GPS information.  Exif data is a risk because by sharing photos over the internet, you may be revealing personal information such as where you live, where you work or where your children go to school.

 You have several options available.

Privacy Action Plan (PAP) - How to remove exif data from your photographs

PRS - Level 3

One way to remove your exif information is to use the details tab within the properties dialog box in File Manager.  Simply find the file within File Manager, then right click on it and choose properties.  Click on the details tab, then click on the link at the bottom that says "Remove Properties and Personal Information"

The following dialogue box will appear:

Choose 'Create a copy with all possible properties removed'.  This will make a separate copy and leave all of your exif data intact in your existing photo.  Or you can leave some of the information there by choosing which attributes you would like removed, such as any GPS information.  This will actually remove the exif data in the existing file.

If you do not have this option available in the properties dialog box, you can remove this information for free online.  This method is less safe than removing it on your computer because you have to upload your photo with the exif information to the website so it can be removed.

There are a number of websites out there that will remove exif data for free, such as http://www.exifremove.com.  You upload the photo to the website and then download a new photo with the exif information removed.

There are various free downloadable tools for doing this as well, some of which can remove exif data from many photos all at once such as this program http://www.exiferaser.com/.  This option avoids the problem above of uploading images to a website.

Of course, you could always attempt to instruct your smartphone or camera to not record exif information to start with (at least the location data).  Some devices will let you do this, others will not.  Some helpful advice can be found here: http://www.icanstalku.com/how.php#disable

Weekly Review of Privacy in the News - Week ended January 24, 2014

Senator Patrick Leahy (D) VT, say the government needs to stop spying on the American people:

http://dailycaller.com/2014/01/19/sen-leahy-on-nsa-spying-we-need-to-stop-government-from-controlling-american-people-video/

Michael Morell, ex-deputy director of the CIA has admitted that there have been minor breeches of the NSA database that tracks the activities of all Americans:

http://dailycaller.com/2014/01/19/top-cia-official-admits-minor-abuses-of-nsa-database-video/

Senator Diane Feinstein (D) CA, tells Americans to get used to NSA database as it is here to stay:

http://thehill.com/blogs/hillicon-valley/technology/195899-feinstein-metadata-program-here-to-stay

The Supreme Court has decided to review whether police can review the information in your cellphone after making an arrest:
http://www.reuters.com/article/2014/01/17/us-usa-court-cellphone-idUSBREA0G1H320140117

Romanian police claim to have caught Guccifer:
http://www.washingtonpost.com/blogs/style-blog/wp/2014/01/22/guccifer-the-hacker-who-leaked-george-w-bush-paintings-reportedly-arrested-in-romania/

Edward Snowden does a live Q&A chat session on January 23 regarding mass surveillance by the government:
http://freesnowden.is/asksnowden.html

Blimp-like surveillance aircraft to be installed for three year period over Maryland:
http://www.washingtonpost.com/business/technology/blimplike-surveillance-crafts-set-to-deploy-over-maryland-heighten-privacy-concerns/2014/01/22/71a48796-7ca1-11e3-95c6-0a7aa80874bc_print.html

Privacy board says bulk data collection of telephone calls is illegal:
http://www.cnn.com/2014/01/23/politics/nsa-telephone-records-privacy/

Republicans call for end to NSA spying:
http://swampland.time.com/2014/01/24/exclusive-republican-party-calls-for-investigation-into-nsa-snooping/

Facebook being sued for sharing private messages between users with third parties:
http://money.cnn.com/2014/01/03/technology/facebook-privacy-lawsuit/

How Exif Data in Your Photos Impacts Your Privacy

When is a picture worth more than a thousand words?  When it contains hidden data that is transferred within the picture file you just emailed unsecurely or shared with the world on Google+.  Exif, which stands for exchangeable image file format, is a standard that specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras.

Exif data contains a number of metadata tags about the photo such as the date and time it was taken, make and model of the camera, various camera settings and other information including GPS information.  The GPS information is the most disturbing part from a privacy perspective.  If you take a photo inside your home and upload it to Google+ someone trying to dox you can instantly determine where you live by simply looking at the GPS coordinates embedded in the photo you uploaded.  Not all cameras record GPS data and some cameras record more exif data than others, but all modern cameras record at least some exif data with each photo taken.  This data follows your photo around, unless you actively take steps to remove it before the photo is uploaded to the internet.

Various social media sites treat exif data differently.  Facebook resizes and compresses photos uploaded to its servers and removes some of the associated exif data.  So does Twitter.  Google+ on the other hand, leaves all of the exif data intact and available for viewing by anyone who has access.

Here is a sample photo I found on the internet that contains a substantial amount of exif data:

You can download this photo to your computer to examine the exif data or you can use various online tools.  If you download it to your computer, you can go to file manager, right click on the photo, select properties and click on the details tab.

If you are browsing the internet and you want to see the exif data without downloading the photo, you can go to a number of online sites, like exifdata.com, which will analyze the photo for you and report the exif data.

If you right click on the photo you want to research and select 'Copy Link Address' or 'Copy Image URL' you can paste it into the 'Submit an image URL' box here:

When we submit that URL, the site returns a significant amount of metadata information related to this photograph:

You can see the photo that was analyzed and some summary information, including where the photo was taken.  If you click on the 'detailed' button, there is even more information about this photo.

That photo you thought was just a picture of you and your family actually tells an entire story that cannot be seen by viewing the photo.

Next week, I will discuss how to remove exif data from your photos.

How To Keep Yourself From Being Doxxed

Yesterday, I discussed some internet resources people use to dox others.  If you recall from yesterday's post, doxxing someone means to 'document' what you can find on the internet about someone and build a dossier on them.

Privacy Action Plan (PAP) - How to Keep Yourself from Being Doxxed
PRS - Level 3

The number one way to keep yourself from being doxxed on the internet is to keep your personal information private.  Whether you are playing online games with anonymous friends or watching youtube videos with friends on tinychat,  you should always limit the personal information you share with people unless you know them well enough to feel comfortable giving them your information.  Even little bits of information, which by themselves may not dox you, can dox you when put these pieces together with other information.  Some people like the challenge of building a dox on another person and will gather the seemingly innocuous things you say together over a period of months to build a dox on you.

Use pseudonyms for every site you register on.  There are no laws that require that you need to use your real name on any site.  If you need to make an email to register, try yandex.com, which allows you to create an email address without providing an identifying information.  While it may be against the site Terms of Service to use a fake name on Facebook, it isn't illegal to do so.  And you should if you want to avoid being doxxed.  Take care in choosing an alias.  Using the fake name 'gameplayer' is far less revealing than something like James1984 if your name is James and you were born in 1984.  James1984 in and of itself isn't going to reveal much about you, but as you talk to people and they learn little bits and pieces about you, this information will become useful in a dox.  In fact, even just your IP address and James1984 would narrow down who you are to just a few possibilities without you saying anything.  If you want to use a real sounding but totally fake name and address, try fakenamegenerator.com.

Use proxies and VPNs (virtual private networks) to hide your IP address.  I am going to have a future post on proxies and VPN's but for now I will summarize.  Proxies and VPN's allow you to browse the internet with a high level of anonymity.  The proxy acts like a shield between your computer and the internet.  Your computer communicates with the proxy server, which goes out and fetches your data and sends it back to you, (typically communications are sent from your computer and received back to you in encrypted form).  There are an abundance of free proxy server choices out there.  For simple proxies suitable for web viewing, try hidemyass.com or look for another at proxy.org.  VPN's are a bit more complex but offer even greater protection.

Remove all exif data from any photos you upload to the internet.  Tomorrow, I will discuss exactly what exif data is, how it can be used to dox you and how it can be removed from your photographs.

What is Doxxing?

You may have never heard the word doxxing, but doxxing is something that has been done, in one form or another, since the first person on the planet learned that someone else is here with them.  There are various definitions on the internet of precisely what this term means, but in summary it means to 'document' what you can find on the internet about someone and build a dossier on them.  Some people take this a step further and publicly reveal what they have learned as part of the doxxing process.  What used to take a private investigator weeks of visiting courthouses and libraries, can be done in minutes using the internet.

In its simplest form, a doxxer might learn of your email address from an innocuous post and trace your email to your real name and address.  In more complex cases, they may be able to dox your family members, learn your medical history, criminal record, education levels and even salaries.  None of this is against the law.  Even publishing this information is legal if all of it was obtained from legal sources (ie - not obtained from stealing someone's password and getting into their Facebook account or hacking into their credit card account, email accounts, etc).  Try using these sites to dox yourself by typing in your name and city or your username (any site will do) or email address and learn what anyone can find out about you.

There are multiple websites you can use to dox someone using various bits and pieces of information you may have obtained about someone and all of them are free:

If someone has sent you an email, you can find out their IP address (Internet protocol address) using helpful information from this site:
http://aruljohn.com/info/howtofindipaddress/.  IP addresses are helpful when performing a dox because you can learn the general area where the person you are doxxing lives (Click here to learn your IP address and associated location data or to search the IP address of someone you know).  An IP address, which works much like a street address used by the postal service, is simply the address of your computer on the internet.  Having an IP address of the person you are doxxing can eliminate 99.99% of the geographical area of the world, though it will not reveal the exact location of the person.  Also, having the ability to decipher an IP address is a great tool if you are receiving emails from multiple accounts claiming to be different people.  You can check their email IP's to know if they are being sent from the same IP, and are thus the same person.

If you don't have an email from the person you are trying to dox, but you are in contact with them in a chat room, forum or IRC, you can use this site if you are clever enough to get the person you are doxxing to click on the link the site provides.  After they click on the link, their IP address is emailed to you (it's free, but your email address is required).

Perhaps one of the best ways to dox someone is through the social media site Facebook.  There is an enormous amount of information on Facebook and Facebook's default settings tend to make everything a user posts public unless a user takes action to increase their privacy.  So even if you aren't friends with someone, you may still be able to glean a significant amount of information from what is available 'publicly' without being friends.

Linkedin.com is another great one for finding people's career history and professional credentials.  It can also be used to determine if you and the person you are doxxing know some of the same people (up to 3 degrees of separation).  Both Facebook and LinkedIn will require you to set up an account in order to access any information.

Pipl.com has accumulated significant amounts of information on millions of people.  When doxxing people, if you have usernames, email addresses or real names, try this site first as they will present multiple options to you as to who you might be looking for.  Often, the person you are looking for is on the pipl.com list.

You can also try typing any information you have about someone into google.com, which can yield surprisingly detailed results.  Another good one is people.yahoo.com.

Spokeo.com gathers similar information to the ones above and even includes some ancestry information.  They say they have more information if you buy a subscription, though I have not tried this.

Zabasearch.com is good for verifying information you have about a specific person to know you are on target during your dox work.  Let's say you are looking for the phone number of John Smith in Anyplace, CA and you know Mr. Smith was born in November of 1982.  If Zabasearch returns a hit, you have added assurance that this is the right John Smith because it includes his city, state and birthday.  The additional data Zabasearch returns, namely the phone and address, is almost surely his current or previous address and phone number.

Some other internet sites you can use for doxxing:
http://www.wink.com/
http://www.123people.com/
http://www.peekyou.com/
http://www.yasni.com/
http://www.anywho.com/whitepages
http://www.peoplefinders.com/

Another site to assist with doxxing is tineye.com.  This site searches an image you upload or a url location you provide and searches it against the trillions of images on the internet.  If the picture you have is anywhere else on the internet, tineye will find it.  Maybe it is in a blog or on Facebook or at reunion.com which can assist you with your doxxing work.

Google also has a powerful image search engine located here: http://www.google.com/imghp
This site can be used to read exif data from photos: http://regex.info/exif.cgi.  Exif data is simply information that your camera stored inside your photo.  It often includes things like where you were when the photo was taken as well as the time and date and potentially other information.  I will have a future post on removing exif data from photos you upload to the internet.

Other great sources of information are county property appraisal websites (Google <county name> property appraiser) and state business registration websites (Google <state name> division of corporations) run by the county and state governments.  With states involved in so many aspects of business these days, many millions of people are in publicly available state licensing websites (Google <state name> professional licensing website).  Everyone from doctors to dentists to hairstylists to dog groomers are in state licensing databases.  These websites and free and are available to the public for browsing.  Also, official records from the courthouse provide pdf copies of things like mortgage documents and can be used to verify things like handwriting and signatures and include information about debts, judgments, liens, divorces and other personal matters (Google <county name> official records).

My next post will be how to best protect yourself from doxxing.