1
00:00:00,000 --> 00:00:03,060
Up next, we have Zoe Salman.

2
00:00:03,180 --> 00:00:09,460
Zoe specializes in OSINT and CTI with experience in private and government sectors.

3
00:00:09,540 --> 00:00:12,880
Also, as we can all see, she is a DEF CON goon.

4
00:00:14,520 --> 00:00:20,460
She's also a Blue Team Village founder and former Trace Labs director.

5
00:00:20,980 --> 00:00:29,460
And the topic that she'll be speaking on is OSINT Privacy Unmasked taking control of your digital footprint in a hyper-connected world.

6
00:00:29,460 --> 00:00:30,920
Now that sounds interesting.

7
00:00:30,920 --> 00:00:32,880
So please give it up for Zoe.

8
00:00:40,050 --> 00:00:40,710
Testing.

9
00:00:40,710 --> 00:00:41,690
Okay, cool, this works.

10
00:00:41,690 --> 00:00:42,630
Great, awesome.

11
00:00:43,070 --> 00:00:49,830
Yeah, so we'll be talking about OSINT Privacy Unmasked, taking control of your digital footprint in a hyper-connected world.

12
00:00:50,270 --> 00:00:51,750
Most of you are going to know me...

13
00:00:52,470 --> 00:00:58,250
Most of you are actually going to know me online as Verbal, but you guys can also call me Zoe, so that's cool too.

14
00:00:59,570 --> 00:01:00,110
Oh.

15
00:01:00,730 --> 00:01:01,490
Uh-oh.

16
00:01:01,830 --> 00:01:03,310
Sorry, Mac problems.

17
00:01:10,490 --> 00:01:11,530
Oh, there we go.

18
00:01:11,530 --> 00:01:12,210
Sorry.

19
00:01:12,490 --> 00:01:14,090
Okay, so, g'day guys.

20
00:01:14,090 --> 00:01:15,010
I am Australian.

21
00:01:15,010 --> 00:01:16,790
I do live in the United States now.

22
00:01:16,790 --> 00:01:18,190
But just a little bit about myself.

23
00:01:18,190 --> 00:01:19,370
Thank you for the intro.

24
00:01:19,390 --> 00:01:22,690
I am one of the co-founders of Blue Team Village.

25
00:01:22,690 --> 00:01:22,970
Woo!

26
00:01:22,970 --> 00:01:23,930
Blue Team!

27
00:01:23,990 --> 00:01:29,090
I'm one of the also OG directors of Trace Labs back in its early days.

28
00:01:29,090 --> 00:01:30,790
Shout out to Trace Labs.

29
00:01:30,890 --> 00:01:35,130
And I also did some volunteer work on the Innocent Lives Foundation as well.

30
00:01:35,130 --> 00:01:44,310
If you guys want to find my socials, Twitter, Mastodon, whatever you want, you can find me on Linktree, and that link is there.

31
00:01:47,630 --> 00:01:49,510
Sorry, I'm going to move this.

32
00:01:51,710 --> 00:01:52,450
There we go.

33
00:01:52,450 --> 00:01:53,310
This is better.

34
00:01:57,940 --> 00:01:58,540
Okay.

35
00:01:58,840 --> 00:02:01,500
So, yeah, I play Dungeons & Dragons.

36
00:02:02,960 --> 00:02:05,260
I've always wanted a character card, so here we go.

37
00:02:05,260 --> 00:02:06,860
I am a human druid.

38
00:02:06,860 --> 00:02:12,400
I originally went between lawful neutral and good neutral, but I decided lawful neutral was the best fit.

39
00:02:12,400 --> 00:02:15,300
I am from Australia, and yes, OSINT is my special ability.

40
00:02:15,860 --> 00:02:17,560
I've always wanted to do that.

41
00:02:18,600 --> 00:02:20,520
So what is this talk actually about?

42
00:02:20,520 --> 00:02:21,620
Why are we here?

43
00:02:21,620 --> 00:02:25,500
So there's a lot of talks about OSINT and how to do OSINT.

44
00:02:25,500 --> 00:02:30,160
There's a lot of awesome content by awesome people about how to actually execute OSINT.

45
00:02:30,160 --> 00:02:32,920
But how do we actually go about defending OSINT?

46
00:02:32,920 --> 00:02:35,940
Because we're all victims of OSINT.

47
00:02:35,940 --> 00:02:42,420
We're all actually being targeted with OSINT, whether you're an organization or an individual.

48
00:02:42,560 --> 00:02:53,760
And so there actually needs to be more information about how individuals can actually go about leveraging what is out there about themselves to actually remove it and better secure our privacy.

49
00:02:55,380 --> 00:02:58,460
So if this is the talk that you're not here for, the exit's that way.

50
00:02:59,260 --> 00:03:05,240
Level zero, just to kind of ground set and level set with everyone, open source intelligence is actually OSINT.

51
00:03:05,240 --> 00:03:06,560
That's what it stands for.

52
00:03:06,560 --> 00:03:10,300
OSINT is Collecting and Analyzing Public Information.

53
00:03:10,300 --> 00:03:14,000
This is public information that can be accessible by anyone.

54
00:03:14,560 --> 00:03:18,760
And just to kind of level set there with everyone, just so everyone in the room knows what that actually is.

55
00:03:18,860 --> 00:03:31,060
Some other things that will be spoken about today is PII, which is Personal Identifiable Information, which is essentially information that can be used really to identify anyone, really.

56
00:03:31,200 --> 00:03:34,400
This could be a name, a phone number, an email address.

57
00:03:34,400 --> 00:03:36,740
You know, an ID number.

58
00:03:36,740 --> 00:03:40,840
Anything that is directly correlated to you is classified as PII.

59
00:03:41,080 --> 00:03:43,900
So we'll talk about some of this later on.

60
00:03:43,920 --> 00:03:48,040
And we'll also be talking about some Privacy Acts, too, and what that actually is.

61
00:03:48,300 --> 00:03:50,640
It's essentially a...

62
00:03:50,640 --> 00:03:55,380
A Privacy Act essentially governs how our data is collected, how our data is controlled.

63
00:03:55,380 --> 00:03:58,480
It's dependent by state, dependent by country.

64
00:03:59,900 --> 00:04:05,820
And every single state, county, country is going to have slightly different Privacy Acts as well.

65
00:04:06,880 --> 00:04:08,400
So, level zero.

66
00:04:11,920 --> 00:04:15,720
Okay, so where are we at in our privacy today?

67
00:04:15,720 --> 00:04:18,140
Where is our privacy at?

68
00:04:18,280 --> 00:04:24,120
The first thing that I'd like to say is if it actually does exist, if this information exists, it can be found.

69
00:04:24,380 --> 00:04:27,660
It's not, it can't be found, it's when will it be found.

70
00:04:27,680 --> 00:04:34,660
You can always find information, but it might not be from, you know, it may not be available now, but it will at some point become available.

71
00:04:34,660 --> 00:04:37,640
Maybe it just takes that specific data breach to happen.

72
00:04:38,100 --> 00:04:41,280
And so that information is always going to be available at some point.

73
00:04:41,400 --> 00:04:56,340
There's actually a funny thing that's kind of happening, is even though we're in that kind of digital information age, even though we're all aware of privacy, of social media, of those risks, despite all of that, our footprints are actually becoming larger and larger.

74
00:04:56,400 --> 00:04:59,080
It sounds kind of intuitive, but that's actually what's happening.

75
00:04:59,080 --> 00:05:04,160
There's more social media platforms being created every day, more things for signing up for.

76
00:05:04,160 --> 00:05:12,160
These days you have to sign up for everything and, you know, people are signing up for all sorts of different things just to get access to services or things.

77
00:05:12,160 --> 00:05:17,100
Things that you didn't actually have to sign up for, you now have to sign up for and give them your information to do so.

78
00:05:17,300 --> 00:05:32,560
This comes at a risk because it's actually way easier now for attackers or just anyone really to leverage that information, not even attackers, but just people that are performing OSINT or want to find information, can relatively find that relatively easy now.

79
00:05:32,580 --> 00:05:36,360
So, DEF CON reference, whose privacy is it anyway?

80
00:05:37,100 --> 00:05:41,800
Privacy is becoming less of a right, unfortunately.

81
00:05:42,200 --> 00:05:54,200
You know, obviously privacy will always be a right, but as things are becoming more online, our actual privacy is getting taken away from us.

82
00:05:54,200 --> 00:06:00,440
We're less in control of what data we have out there and how that data is actually being used.

83
00:06:01,040 --> 00:06:05,520
So, I mean, when you're signing up for things, who knows where that data is going?

84
00:06:06,280 --> 00:06:08,600
It can end up anywhere.

85
00:06:09,280 --> 00:06:17,820
And the consequences of it is actually very drastic and our privacy is eroding drastically every single year.

86
00:06:18,220 --> 00:06:23,620
The thing is, though, organisations love this because they monetise off our data.

87
00:06:24,340 --> 00:06:25,660
Data is being sold.

88
00:06:25,660 --> 00:06:26,780
Data is being exchanged.

89
00:06:26,780 --> 00:06:28,280
Data is becoming a currency.

90
00:06:28,380 --> 00:06:36,100
There is now a stage where data is actually more important and valuable than actual money itself, because you can exchange information.

91
00:06:36,240 --> 00:06:39,160
Things that organisations want is data and information.

92
00:06:39,160 --> 00:06:43,040
And so our data and information is incredibly valuable to organisations.

93
00:06:43,620 --> 00:06:48,480
And so the thing is that it's kind of difficult for us is we know how to do the OSINT.

94
00:06:48,480 --> 00:06:50,000
We know how to find the data.

95
00:06:50,000 --> 00:06:59,040
But because of the nature of organisations wanting to keep this data, there's not really much information about how to actually remove this data and where this data is actually going.

96
00:06:59,540 --> 00:07:07,280
So this is going to be kind of jumping into how to take back control of your data and understand where your data is going and how it's being used.

97
00:07:13,600 --> 00:07:15,780
OK, so the first thing you actually want to do...

98
00:07:15,780 --> 00:07:17,600
I'm going to break this down into different steps.

99
00:07:18,660 --> 00:07:20,680
And, yes, I love Game of Thrones as well.

100
00:07:21,100 --> 00:07:25,420
You actually want to identify your comfortability levels.

101
00:07:25,600 --> 00:07:30,100
And this is really important, because it's going to be unique to each person.

102
00:07:30,180 --> 00:07:33,680
There's going to be some people in this room that don't want people to know their name.

103
00:07:33,740 --> 00:07:37,080
And there's going to be some people in this room who are OK with putting their name out there.

104
00:07:37,140 --> 00:07:41,540
And so it's totally up to you what information you feel comfortable with.

105
00:07:41,540 --> 00:07:42,740
But you've got to start there.

106
00:07:42,740 --> 00:07:47,400
You have to know what is OK out there and what you don't want out there.

107
00:07:47,400 --> 00:07:49,900
So identifying, do you want your email address out there?

108
00:07:49,900 --> 00:07:51,600
Do you want your phone number out there?

109
00:07:51,740 --> 00:07:53,900
Who are you OK giving this information to?

110
00:07:53,900 --> 00:07:56,400
And who are you not OK giving this information to?

111
00:07:56,540 --> 00:07:59,400
In a Blue Team term, we would call this like a scope.

112
00:07:59,400 --> 00:08:00,700
And essentially this is what we're doing.

113
00:08:00,700 --> 00:08:02,160
We're scoping a project.

114
00:08:03,580 --> 00:08:06,160
And so we want to set ourselves a scope.

115
00:08:06,180 --> 00:08:09,140
We want to know and work out and sit down and brainstorm.

116
00:08:09,380 --> 00:08:13,860
OK, well, I don't want my social security number being out there, but I don't mind if people know my name.

117
00:08:13,860 --> 00:08:19,140
And once you kind of have that distinction, it's very clear what you need to remove.

118
00:08:19,140 --> 00:08:22,480
Until you've identified that, you don't actually know what you need to remove.

119
00:08:23,280 --> 00:08:25,640
So that's where you need to go, what is OK to be public?

120
00:08:25,920 --> 00:08:36,440
And once I said it's going to be dependent on you, what your role is, how public you want to be, and every single person in this room is going to be totally different.

121
00:08:36,540 --> 00:08:40,320
So if one person doesn't want to reveal their name, that's totally fine, up to them.

122
00:08:40,360 --> 00:08:43,160
But it doesn't mean you don't have to, it's totally up to you.

123
00:08:43,160 --> 00:08:49,700
And then working out what information crosses that line and documenting that and being aware of that information.

124
00:08:55,140 --> 00:08:59,120
OK, this might be the most important slide I talk about, so please do pay attention to this.

125
00:08:59,140 --> 00:09:01,800
Please create separation.

126
00:09:02,880 --> 00:09:04,260
I will repeat that.

127
00:09:04,260 --> 00:09:05,900
Please create separation.

128
00:09:05,900 --> 00:09:12,820
And what I'm referring to, I mean your separation between your work profile and your online profile, your personal profile.

129
00:09:13,080 --> 00:09:15,080
That is really, really important.

130
00:09:15,080 --> 00:09:19,340
Because let's just say you have ten social accounts.

131
00:09:19,760 --> 00:09:22,440
Five of them are work, five of them are personal.

132
00:09:22,680 --> 00:09:29,400
If you use your personal information for all ten, you now have doubled your footprint for no reason.

133
00:09:29,580 --> 00:09:40,520
If you use your work information, which is already publicly accessible, because it's probably on your LinkedIn page, and then you use your personal information for your personal stuff, you have just halved your footprint.

134
00:09:41,360 --> 00:09:56,140
So things like using your work email for things that you would use for work, using your work mobile for things you would use for work, creating that separation is so important, not just from a stance of an individual, but also from the stance of an organisation.

135
00:09:56,280 --> 00:09:59,780
Organisations should encourage their employees to create separation.

136
00:10:01,000 --> 00:10:07,360
And once again, you have to kind of identify what is actually used for work and what is not used for work.

137
00:10:07,360 --> 00:10:25,820
A good example of this would be, say, for instance, if you were to be in a data breach, and your work account gets breached, but you've used your work email address, you've used your work address, which is on their website footer anyway, and you've used your work mobile number,

138
00:10:25,820 --> 00:10:28,680
the level of risk is relatively minimal.

139
00:10:28,900 --> 00:10:43,940
And then it would be up to your organisation to determine what to do, because you work for them and then you can notify them that, that kind of creates that separation between what you're responsible for in terms of your data.

140
00:10:44,460 --> 00:10:55,120
Whereas your personal information, you can then also do the same sort of thing, use your personal emails, use your personal information there, but having that separation is just super important.

141
00:10:55,700 --> 00:11:00,620
Minimises the footprint literally by half, depending on how many accounts you have, what you use for work.

142
00:11:00,620 --> 00:11:10,260
I know when I was going through my stuff, I used so many work accounts, and I'm like, oh yeah, okay, I literally just halved my footprint, just like that, and it was, you know, drastic.

143
00:11:10,520 --> 00:11:18,360
So I do encourage, if you're an individual, do take this initiative, and if you're an organisation, please do encourage your employees to take this initiative too.

144
00:11:24,600 --> 00:11:26,760
And also evaluating your public presence.

145
00:11:26,760 --> 00:11:29,620
This may seem obvious, but there's a lot of people that actually don't do this.

146
00:11:30,240 --> 00:11:35,640
You need to know what data is out there about you to actually be able to identify what you need to remove.

147
00:11:35,840 --> 00:11:40,480
And the thing is with this, a bit of cognitive bias will come into play here.

148
00:11:40,580 --> 00:11:53,460
So yes, you can do it yourself, of course, but I do recommend actually someone else doing it, like a friend, someone like that, who you trust, because you're going to know where your information is, and you may actually also not look in places that other people might.

149
00:11:54,280 --> 00:12:02,980
And so that is actually the best way, is you do your own kind of OSINT on yourself, and then get a good friend to also do some OSINT on you too.

150
00:12:02,980 --> 00:12:09,320
So you have two sets of data, and you can work out, OK, well, this is what is actually out there about me.

151
00:12:09,580 --> 00:12:13,540
If you're an organisation, you can actually hire people to do this for you.

152
00:12:13,720 --> 00:12:19,480
And this really gives you general awareness of the type of data that is out there about you or your organisation.

153
00:12:20,120 --> 00:12:22,600
You can't really... you know, you can't really...

154
00:12:22,600 --> 00:12:23,580
It's kind of like a pen test.

155
00:12:23,580 --> 00:12:26,020
You have to do the pen test first to know how to fix it.

156
00:12:26,640 --> 00:12:28,040
It's the same kind of concept.

157
00:12:28,040 --> 00:12:35,240
You have to understand what is out there, what the risk is, and where people are getting this information from to then mitigate against it.

158
00:12:48,110 --> 00:12:49,610
So we've done some talking here.

159
00:12:49,610 --> 00:12:52,090
I've gone through a few actionable steps.

160
00:12:52,370 --> 00:12:55,190
You know, we've spoken about you actually need to create the separation.

161
00:12:55,190 --> 00:12:57,350
You need to identify what you're comfortable with.

162
00:12:57,550 --> 00:12:59,550
You need to do some OSINT on yourself.

163
00:12:59,630 --> 00:13:03,410
But what we're actually here to talk about is more deeper than that.

164
00:13:03,410 --> 00:13:06,470
How do we actually go about removing our data?

165
00:13:06,470 --> 00:13:08,370
This is the stuff you guys are probably here for.

166
00:13:08,950 --> 00:13:10,650
And we're going to answer that.

167
00:13:10,830 --> 00:13:21,410
And so please do be patient with this, because it is a little bit of a lengthy process in the way that things actually get broken down and how we actually have to go about doing this.

168
00:13:25,400 --> 00:13:26,500
Data brokers.

169
00:13:26,500 --> 00:13:27,420
Love data brokers.

170
00:13:27,420 --> 00:13:28,400
No, I don't.

171
00:13:29,240 --> 00:13:35,760
Okay, so opting out of data brokers is something that I really recommend to everyone.

172
00:13:36,140 --> 00:13:50,220
This is just a small list of data brokers, but things like Experian, Equifax, LexisNexis, TransUnion, Axiom, CoreLogic, they are kind of what I call the top data brokers.

173
00:13:50,220 --> 00:13:52,580
That's where most people are getting their data from.

174
00:13:52,580 --> 00:14:02,600
This could be things like marketing campaigns, ads, people, you know, when you get those people that send you mail that's like, you've been qualified for $1,000.

175
00:14:03,480 --> 00:14:06,000
Yeah, this is where they're getting that information from.

176
00:14:06,340 --> 00:14:11,040
So opting out at the top level is going to be the most successful thing.

177
00:14:11,280 --> 00:14:15,140
And it's a bit of a slow process, because they don't make it easy.

178
00:14:15,140 --> 00:14:16,180
They want your data.

179
00:14:16,180 --> 00:14:21,280
This is the problem we have with privacy today, is they want your data because they monetize off it.

180
00:14:21,300 --> 00:14:24,560
And so they make it as difficult as they possibly can.

181
00:14:24,980 --> 00:14:27,880
I have been through this process multiple times.

182
00:14:28,220 --> 00:14:31,480
I recommend it, but you do have to be patient with it.

183
00:14:31,520 --> 00:14:36,520
It is something that does work, but it does take time.

184
00:14:36,520 --> 00:14:37,640
It isn't immediate.

185
00:14:37,640 --> 00:14:44,540
You might not see any real results for six months, but you will eventually notice that your footprint is becoming smaller and smaller.

186
00:14:44,540 --> 00:14:51,980
You will start getting less junk mail, less spam, less phone calls, things like that, because that data is no longer available.

187
00:14:51,980 --> 00:14:55,660
Unless, of course, they're updating it again, if they're getting it from another data broker.

188
00:14:55,760 --> 00:14:56,460
Sometimes.

189
00:14:58,040 --> 00:14:59,800
So, yeah, you really want to start at the top.

190
00:14:59,800 --> 00:15:04,140
You want to start at the top of the food chain, which is with the main data brokers.

191
00:15:04,200 --> 00:15:06,700
Another one on this list that I didn't mention is Oracle.

192
00:15:07,040 --> 00:15:12,240
I didn't know they actually had a whole entire data broker business until recently, and I was like, oh, wow, that's wild.

193
00:15:12,240 --> 00:15:15,260
But, yeah, they actually make a bunch of money on data broking.

194
00:15:15,460 --> 00:15:17,120
So that's another one on the list.

195
00:15:17,120 --> 00:15:30,120
And I will actually have some resources that I will distribute after this talk, along with obviously the slides and things like that, with a long kind of to-do list for everyone that is actionable with these links and resources and things, too.

196
00:15:30,320 --> 00:15:34,780
So once you've actually gone through and opted out of them, how do we actually go about doing that?

197
00:15:35,800 --> 00:15:43,800
One thing that you can actually do is every single of these sites and data brokers will have a privacy policy, I would hope.

198
00:15:44,320 --> 00:15:57,680
You can actually go into that privacy policy, and you can just kind of do like Control-F and filter for keywords like delete, remove, until you find the section where it gives you the opt-out functions.

199
00:15:58,100 --> 00:16:06,320
I know when I did this with, I think it was Equifax, there was about six different opt-out forms I had to fill out.

200
00:16:06,560 --> 00:16:08,500
As I said, they don't make it easy.

201
00:16:08,500 --> 00:16:11,660
They make it incredibly difficult because they want your data.

202
00:16:12,500 --> 00:16:16,320
And so opting out is a bit of a process here.

203
00:16:16,380 --> 00:16:24,240
But the other thing as well is that will overall filter into making your footprint smaller.

204
00:16:25,940 --> 00:16:27,100
Yes.

205
00:16:34,630 --> 00:16:42,570
Now we're going to talk about data collectors, which also goes hand-in-hand with the opt-out process for data brokers.

206
00:16:42,570 --> 00:16:47,370
I want to just call out here that the FCC resources, they are not a data collector.

207
00:16:47,610 --> 00:16:49,530
I just want to make that really, really clear.

208
00:16:49,530 --> 00:16:57,690
They actually have a fantastic resource on their website that lets you opt-out of like marketing call communications.

209
00:16:58,130 --> 00:17:07,990
They put you on like a do-not-sell list, essentially, and over time when people kind of fetch this list, you will not be on there.

210
00:17:07,990 --> 00:17:13,810
So they kind of push that out on a bit more of a US-wide scale.

211
00:17:13,810 --> 00:17:28,950
I really recommend that because they have you on like a do-not-call list, do-not-email list, do-not-mail list, and there's actually a bunch of different sub-sections on the FCC site that you can actually opt-out from.

212
00:17:29,310 --> 00:17:34,910
And they're very granular and specific about what you can and can't opt-out of, and they make it very clear and simple.

213
00:17:34,910 --> 00:17:37,830
But another thing, as well, is internet providers.

214
00:17:38,190 --> 00:17:43,490
I wanted to also specify that opting out does not stop the service.

215
00:17:43,570 --> 00:17:54,390
If you opt-out of something, if you're opting out of like Equifax, TransUnion, credit reporting bureaus, you're not deleting your credit score, you're not removing your credit score data.

216
00:17:54,390 --> 00:17:55,230
That still exists.

217
00:17:55,230 --> 00:17:57,630
It doesn't impact your credit score or any of those sort of things.

218
00:17:57,630 --> 00:17:59,150
So I think there's a bit of a misconception there.

219
00:17:59,150 --> 00:18:01,050
I want to just clarify with everyone.

220
00:18:01,210 --> 00:18:16,790
What you're essentially opting out of is opting out for them to use your data for monetary purposes or to trade or whatever transactional purpose they use your data for, whether it's monetary or for another purpose or for another marketing campaign or organisation.

221
00:18:18,010 --> 00:18:19,270
Same with internet providers.

222
00:18:19,270 --> 00:18:20,850
Opting out doesn't stop your service.

223
00:18:20,850 --> 00:18:22,930
You're not deleting your account per se.

224
00:18:22,930 --> 00:18:28,850
You're just telling them, hey, you can't use my data anymore, and they should be cool with that.

225
00:18:29,350 --> 00:18:31,890
Phone providers, people search sites.

226
00:18:31,890 --> 00:18:45,930
I tend to call these the bottom feeders, I guess, because you have the top data brokers, and then you have these guys where they get a lot of their information from, but they also collect information, so therefore they're in the middle and they also distribute information.

227
00:18:46,770 --> 00:18:48,070
Rewards programs.

228
00:18:49,050 --> 00:18:51,050
I have a funny story.

229
00:18:51,050 --> 00:19:01,670
I moved to the United States four years ago, and when I moved here, I thought it would be cool to sign up for a bunch of reward programs because I wanted to feel like I belonged here.

230
00:19:01,790 --> 00:19:03,850
So I was like, yeah, sure, I'll sign up with Kroger.

231
00:19:04,050 --> 00:19:05,330
So much regret.

232
00:19:06,430 --> 00:19:20,330
The thing with rewards programs is they kind of try to convince you that you're going to get something beneficial from it, like $5 every three months, but you kind of got to think, okay, is it actually worth them having my data?

233
00:19:20,730 --> 00:19:22,110
Do I need a Kroger account?

234
00:19:22,110 --> 00:19:23,510
Do I need a Publix account?

235
00:19:23,510 --> 00:19:27,990
Is there a functional service that they're offering me where I need an account for?

236
00:19:27,990 --> 00:19:34,250
And kind of going through that and understanding, okay, like Dick's Sporting Goods, do I need an account for that?

237
00:19:34,250 --> 00:19:35,350
Maybe you do, maybe you don't.

238
00:19:35,350 --> 00:19:36,110
Up to you.

239
00:19:36,110 --> 00:19:44,930
And this goes back to understanding what you want out of your data privacy because everyone's going to have individual goals on what they're trying to achieve.

240
00:19:45,270 --> 00:19:47,590
For me, I went through and I deleted so much stuff.

241
00:19:47,590 --> 00:19:48,650
It was fantastic.

242
00:19:48,650 --> 00:19:51,230
And I'm like, yay, I'm free of the rewards programs.

243
00:19:52,070 --> 00:19:56,330
So yeah, working out what you're wanting to have out of that or not.

244
00:19:57,990 --> 00:20:18,350
The thing as well is sometimes when you sign up for things at the bottom of the sign-up screen where they say like, yes, I agree to the privacy policy, check what's actually in the privacy policy because they may not actually state in the line there that they're selling you information.

245
00:20:18,350 --> 00:20:23,470
Some places will actually have it separate, but it's dependent on how their legal team has done it, to be honest.

246
00:20:24,530 --> 00:20:33,350
Some places you can actually check like, yes, I agree to terms and conditions, but no, you can't keep my information for marketing purposes.

247
00:20:33,530 --> 00:20:36,190
But then some will just have like one where it's all just clustered in together.

248
00:20:36,190 --> 00:20:40,930
So if you're accepting to use their service, you could just be accepting everything collectively.

249
00:20:41,550 --> 00:20:48,830
So you also got to kind of weigh out the pros and cons of that too as an individual and work out, is that something that you want to risk?

250
00:20:48,830 --> 00:20:50,630
Is that a service I really need?

251
00:20:50,630 --> 00:20:55,890
How much exposure is this going to provide, you know, my information out there to the world?

252
00:20:56,630 --> 00:21:01,650
Same with, you know, phone providers are notorious for sharing information, as I'm sure we all know.

253
00:21:02,210 --> 00:21:03,670
People search sites.

254
00:21:05,510 --> 00:21:17,510
They collect information and they share it and you can pay for information and things like that too, but they get a lot of that from collectively everyone else and also historical records as well.

255
00:21:17,710 --> 00:21:22,950
One thing that I actually did not add on this slide, but I wanted to mention, is county records.

256
00:21:23,170 --> 00:21:30,490
You can actually go to your county or whatever counties you have lived in and you can actually request everything they have on you.

257
00:21:30,790 --> 00:21:32,050
That is totally allowed.

258
00:21:32,050 --> 00:21:36,970
They have to give you everything that they have or any sort of records.

259
00:21:37,310 --> 00:21:41,690
It's kind of like a FOIA request, but for just you in your county.

260
00:21:41,830 --> 00:21:48,190
They'll give you whatever records they can provide and then some records they'll even let you redact it as well.

261
00:21:48,190 --> 00:21:58,230
It's dependent on what their county and state laws are, so I can't be too specific around it, but you want to check with them on what can actually be redacted.

262
00:21:58,230 --> 00:22:07,210
So if you're really wanting to go gung-ho on this and really hide everything, that might be an option for you, is checking with your county records.

263
00:22:13,640 --> 00:22:16,320
Okay, the actual data removal process.

264
00:22:16,900 --> 00:22:20,620
This might sound kind of intuitive, but you actually want to start with your password manager.

265
00:22:20,620 --> 00:22:25,900
And this is a great place to start with because it gives you a record of everything you have access to.

266
00:22:26,220 --> 00:22:30,520
So it's essentially a log for all the sites you've signed up for.

267
00:22:30,920 --> 00:22:32,280
So you want to start there.

268
00:22:32,700 --> 00:22:35,960
I did it in alphabetical order because that worked for me.

269
00:22:36,280 --> 00:22:39,120
And as I said, it's a bit of a lengthy process.

270
00:22:39,500 --> 00:22:43,320
But you can literally just go site by site by site and go, do I need this?

271
00:22:43,320 --> 00:22:44,500
Yes, no.

272
00:22:44,500 --> 00:22:46,500
Log in, delete the account.

273
00:22:46,940 --> 00:22:49,460
There's a few different ways you can actually delete accounts.

274
00:22:49,460 --> 00:22:55,440
Some places will actually let you log in directly and delete the account, which is great.

275
00:22:55,520 --> 00:22:58,160
Clap to them if they do that because that's fantastic.

276
00:22:58,880 --> 00:23:07,800
Some places you have to actually go into their privacy policy and actually do an account deletion request via that.

277
00:23:08,320 --> 00:23:12,560
And then there are a couple of sites I've come across where they don't let you delete that unless you email them.

278
00:23:13,480 --> 00:23:14,820
So there's that too.

279
00:23:14,820 --> 00:23:20,940
And you can email them and usually they're pretty responsive and they can go ahead and do that deletion request for you.

280
00:23:21,020 --> 00:23:25,980
But this is essentially a great place to start when you're looking at how do I actually remove my footprint.

281
00:23:25,980 --> 00:23:35,760
Start with the accounts you already have access to, the things you already signed up for, because this is going to help everything in the future and help overall minimise your existing footprint.

282
00:23:37,160 --> 00:23:38,620
Conduct regular maintenance.

283
00:23:38,740 --> 00:23:46,320
The first time you do this, it's going to take a while and we'll kind of talk about some timeframes and things overall on one of the upcoming slides.

284
00:23:46,320 --> 00:23:55,980
But once you do this, it only takes about once a year, like an hour, two, maybe three hours a year to kind of keep this maintained.

285
00:23:55,980 --> 00:23:59,280
In the grand scheme of things, that's actually not really a lot of time.

286
00:23:59,980 --> 00:24:07,860
So that is something that I do recommend, is just sitting down once a year and just kind of going over all your accounts you signed up for in the past year.

287
00:24:08,220 --> 00:24:11,320
The first time I did this...

288
00:24:11,320 --> 00:24:11,800
Sorry.

289
00:24:13,720 --> 00:24:18,480
The first time I did this, I had a bunch of accounts.

290
00:24:18,600 --> 00:24:19,780
It took a while.

291
00:24:20,440 --> 00:24:24,740
But now that I've actually done it, it's pretty easy to maintain.

292
00:24:24,740 --> 00:24:27,120
It's no longer a challenge, no longer a chore.

293
00:24:27,120 --> 00:24:30,260
I'm a lot more aware now about what to do moving forward.

294
00:24:42,660 --> 00:24:43,840
But wait, guys, there's more.

295
00:24:43,840 --> 00:24:45,240
It's a sales pitch and I'm joking.

296
00:24:46,160 --> 00:24:47,440
Browser cookies.

297
00:24:47,440 --> 00:24:54,920
Similar to how organisations are wanting to have all your data, so are browser cookies.

298
00:24:54,920 --> 00:25:05,560
By default, a lot of sites, not all of them, but a lot of sites, when you click that allow all cookies button, you're literally just saying, hey, yeah, have everything.

299
00:25:05,800 --> 00:25:10,140
There are some sites that do let you be very specific about the cookies you're giving them.

300
00:25:10,420 --> 00:25:13,380
And sometimes you don't even need cookies for the site either.

301
00:25:13,380 --> 00:25:16,460
It's kind of just that sense of they...

302
00:25:16,460 --> 00:25:19,300
it's almost like a bit of a social engineering tactic.

303
00:25:19,300 --> 00:25:28,800
They have a little banner that pops up and it kind of convinces you that you actually need to give them your cookies to access the site, but you don't really need to.

304
00:25:28,920 --> 00:25:31,620
It's dependent on the site, of course.

305
00:25:32,240 --> 00:25:37,140
But that is just something to be really aware of as well.

306
00:25:38,060 --> 00:25:39,160
Alternative emails.

307
00:25:39,160 --> 00:25:42,040
I know a bunch of people that do this and I love it.

308
00:25:42,040 --> 00:25:46,760
Because when you are in a data breach, you know exactly where it came from.

309
00:25:46,760 --> 00:25:49,200
I highly recommend this.

310
00:25:49,600 --> 00:25:59,640
I see a bunch of people that will have like eventbrite.handle at blah, blah, blah, blah, blah, or facebook.blah, blah, blah.

311
00:25:59,780 --> 00:26:06,020
And so they have a specific alias email that they're giving to that specific entity.

312
00:26:07,200 --> 00:26:14,160
If you... I don't know about Android specifically, but if you are an Apple user, given my MacBook, I clearly am.

313
00:26:15,680 --> 00:26:19,660
Apple actually has a really cool function embedded where you can actually do this automatically.

314
00:26:20,080 --> 00:26:22,360
You don't have to go ahead and create it for you.

315
00:26:22,360 --> 00:26:23,600
They do it all for you.

316
00:26:23,600 --> 00:26:25,780
It's actually under the iCloud settings.

317
00:26:26,260 --> 00:26:30,740
You can actually log in with Apple and they create you different aliases for every single login.

318
00:26:30,920 --> 00:26:32,180
I personally love that.

319
00:26:32,180 --> 00:26:39,740
I do think it's a great way to easily manage something without having to create each individual email alias yourself.

320
00:26:40,360 --> 00:26:43,340
But also it depends on what provider you're wanting to use.

321
00:26:43,340 --> 00:26:49,660
If you're wanting to use another email provider, a lot of them offer this as a service for email providers.

322
00:26:50,280 --> 00:26:51,920
And changing your data.

323
00:26:52,300 --> 00:27:02,840
This is an interesting one because there's so much data out there about us, but it's also... have you ever seen on like Zillow how you can like claim a house?

324
00:27:03,060 --> 00:27:05,440
You can like log in like, yep, this is my house.

325
00:27:05,440 --> 00:27:08,260
Well, once you do that, you can do whatever you want with that data.

326
00:27:08,320 --> 00:27:09,880
Because you've said, yeah, this is my data.

327
00:27:09,880 --> 00:27:11,340
I've proven this is my data.

328
00:27:11,620 --> 00:27:13,160
I cannot change that data.

329
00:27:14,420 --> 00:27:26,360
That's the great way to kind of change what is out there, almost like a little bit of misinformation, is claiming that data and then changing it or removing it or whatever you want to do with that data.

330
00:27:26,360 --> 00:27:29,880
Just putting that out there as an option because that might be beneficial to some people.

331
00:27:32,760 --> 00:27:38,620
A good example of this would be things like white pages, PeopleLooker, things like that.

332
00:27:38,860 --> 00:27:47,400
Obviously, over time, once you've opted out from those kind of top-level data brokers and the bottom feeders are kind of catching up and saying, yep, okay, this data no longer exists.

333
00:27:47,400 --> 00:27:58,940
Eventually, you're going to see that that data won't be distributed as much, but it's still going to exist as a historical record on things like PeopleLooker, white pages, things like that.

334
00:27:58,940 --> 00:28:09,200
And so that's a great way to actually claim that data and then remove it because you now own that data and you've proven it's yours and now you can take control of that data.

335
00:28:15,730 --> 00:28:18,190
Statistics, because who doesn't love statistics?

336
00:28:18,810 --> 00:28:23,070
Just a little bit of info about the whole data broking, selling information.

337
00:28:23,150 --> 00:28:28,170
What I'm referring to is organizations, and so many organizations do this.

338
00:28:28,170 --> 00:28:31,590
They buy and they sell and they trade information from each other.

339
00:28:31,670 --> 00:28:35,250
As I mentioned, information is incredibly valuable in OSINT.

340
00:28:35,950 --> 00:28:42,130
It's valuable to all organizations, things like marketing organizations, things like that, too.

341
00:28:42,650 --> 00:28:49,170
Just in 2022 alone, it is a $300 billion industry.

342
00:28:49,370 --> 00:28:51,690
Yes, selling your data is an industry.

343
00:28:52,770 --> 00:29:00,410
There are actually projections out there by brokers where they're actually estimating that by 2020...

344
00:29:00,410 --> 00:29:02,130
Actually, I think I typed that wrong.

345
00:29:02,130 --> 00:29:03,470
I think it was supposed to be 2030.

346
00:29:03,470 --> 00:29:04,450
Yeah, I typed that wrong.

347
00:29:04,450 --> 00:29:05,350
My mistake.

348
00:29:05,690 --> 00:29:13,870
By 2030, they're estimating $500 billion is the actual estimated value of all of our data.

349
00:29:14,250 --> 00:29:16,670
So that goes to show how much our data is worth.

350
00:29:17,490 --> 00:29:19,570
But how much is it worth to you guys?

351
00:29:20,310 --> 00:29:33,930
Roughly, it would say, on average, about six hours per year is all it's going to take for you to actually do something about it, to minimize your footprint, to take action on some of these things we've spoken about.

352
00:29:33,990 --> 00:29:38,950
There's going to be some people who are going to go ahead and do this, and there's going to be some people who don't.

353
00:29:38,950 --> 00:29:45,370
So you've kind of got to think about how much time is your privacy actually worth?

354
00:29:46,510 --> 00:30:01,930
Because if you go out there and you don't do anything about it, and other organizations have your data and things like that, unfortunately, there is not a way to automate this.

355
00:30:01,930 --> 00:30:06,750
It isn't something that you can just go out there and click a button and delete all.

356
00:30:07,530 --> 00:30:09,430
And I think that is intentional.

357
00:30:09,550 --> 00:30:13,170
I really think that a lot of organizations do that intentionally.

358
00:30:13,490 --> 00:30:21,390
So you've got to think about how much time is your privacy worth and spend that kind of time to invest in your own privacy for future.

359
00:30:28,090 --> 00:30:29,390
I do have a challenge.

360
00:30:30,390 --> 00:30:33,370
Ice cream social challenge.

361
00:30:33,370 --> 00:30:42,150
I have the last EFF privacy badger cert bot.

362
00:30:42,150 --> 00:30:47,290
My husband and I created this for EFF.

363
00:30:47,290 --> 00:30:48,790
There's one left.

364
00:30:48,790 --> 00:30:50,170
We have a challenge.

365
00:30:50,170 --> 00:31:00,750
The first person that can provide me evidence in a photo form, you need to get strawberry Ben and Jerry's and give it to Zant.

366
00:31:01,250 --> 00:31:02,690
Don't ask questions.

367
00:31:03,070 --> 00:31:04,330
No questions asked.

368
00:31:06,170 --> 00:31:28,210
Whoever can provide me evidence of that, the first person via Twitter, LinkedIn, whatever platform, the first person that can find strawberry Ben and Jerry's and give it to Zant, I'll give you a hint, Zant is a goon, wins the very last one of these privacy badger EFF badges.

369
00:31:30,760 --> 00:31:32,300
Thanks, guys.