[00:00.000 --> 00:03.060]  Up next, we have Zoe Salman.
[00:03.180 --> 00:09.460]  Zoe specializes in OSINT and CTI with experience in private and government sectors.
[00:09.540 --> 00:12.880]  Also, as we can all see, she is a DEF CON goon.
[00:14.520 --> 00:20.460]  She's also a Blue Team Village founder and former Trace Labs director.
[00:20.980 --> 00:25.480]  And the topic that she'll be speaking on is OSINT Privacy Unmasked
[00:25.480 --> 00:29.460]  taking control of your digital footprint in a hyper-connected world.
[00:29.460 --> 00:32.880]  Now that sounds interesting. So please give it up for Zoe.
[00:40.050 --> 00:42.630]  Testing. Okay, cool, this works. Great, awesome.
[00:43.070 --> 00:45.770]  Yeah, so we'll be talking about OSINT Privacy Unmasked,
[00:45.770 --> 00:49.830]  taking control of your digital footprint in a hyper-connected world.
[00:50.270 --> 00:51.750]  Most of you are going to know me...
[00:52.470 --> 00:55.650]  Most of you are actually going to know me online as Verbal,
[00:55.650 --> 00:58.250]  but you guys can also call me Zoe, so that's cool too.
[00:59.570 --> 01:01.490]  Oh. Uh-oh.
[01:01.830 --> 01:03.310]  Sorry, Mac problems.
[01:10.490 --> 01:12.210]  Oh, there we go. Sorry.
[01:12.490 --> 01:16.790]  Okay, so, g'day guys. I am Australian. I do live in the United States now.
[01:16.790 --> 01:19.370]  But just a little bit about myself. Thank you for the intro.
[01:19.390 --> 01:22.690]  I am one of the co-founders of Blue Team Village.
[01:22.690 --> 01:23.930]  Woo! Blue Team!
[01:23.990 --> 01:29.090]  I'm one of the also OG directors of Trace Labs back in its early days.
[01:29.090 --> 01:30.790]  Shout out to Trace Labs.
[01:30.890 --> 01:35.130]  And I also did some volunteer work on the Innocent Lives Foundation as well.
[01:35.130 --> 01:40.050]  If you guys want to find my socials, Twitter, Mastodon, whatever you want,
[01:40.050 --> 01:44.310]  you can find me on Linktree, and that link is there.
[01:47.630 --> 01:49.510]  Sorry, I'm going to move this.
[01:51.710 --> 01:53.310]  There we go. This is better.
[01:57.940 --> 02:01.500]  Okay. So, yeah, I play Dungeons & Dragons.
[02:02.960 --> 02:05.260]  I've always wanted a character card, so here we go.
[02:05.260 --> 02:10.420]  I am a human druid. I originally went between lawful neutral and good neutral,
[02:10.420 --> 02:12.400]  but I decided lawful neutral was the best fit.
[02:12.400 --> 02:15.300]  I am from Australia, and yes, OSINT is my special ability.
[02:15.860 --> 02:17.560]  I've always wanted to do that.
[02:18.600 --> 02:21.620]  So what is this talk actually about? Why are we here?
[02:21.620 --> 02:25.500]  So there's a lot of talks about OSINT and how to do OSINT.
[02:25.500 --> 02:30.160]  There's a lot of awesome content by awesome people about how to actually execute OSINT.
[02:30.160 --> 02:32.920]  But how do we actually go about defending OSINT?
[02:32.920 --> 02:35.940]  Because we're all victims of OSINT.
[02:35.940 --> 02:39.540]  We're all actually being targeted with OSINT,
[02:39.540 --> 02:42.420]  whether you're an organization or an individual.
[02:42.560 --> 02:45.320]  And so there actually needs to be more information about how individuals
[02:45.320 --> 02:50.400]  can actually go about leveraging what is out there about themselves
[02:50.400 --> 02:53.760]  to actually remove it and better secure our privacy.
[02:55.380 --> 02:58.460]  So if this is the talk that you're not here for, the exit's that way.
[02:59.260 --> 03:02.520]  Level zero, just to kind of ground set and level set with everyone,
[03:02.520 --> 03:06.560]  open source intelligence is actually OSINT. That's what it stands for.
[03:06.560 --> 03:10.300]  OSINT is Collecting and Analyzing Public Information.
[03:10.300 --> 03:14.000]  This is public information that can be accessible by anyone.
[03:14.560 --> 03:16.560]  And just to kind of level set there with everyone,
[03:16.560 --> 03:18.760]  just so everyone in the room knows what that actually is.
[03:18.860 --> 03:22.300]  Some other things that will be spoken about today is PII,
[03:22.300 --> 03:24.700]  which is Personal Identifiable Information,
[03:24.700 --> 03:31.060]  which is essentially information that can be used really to identify anyone, really.
[03:31.200 --> 03:34.400]  This could be a name, a phone number, an email address.
[03:34.400 --> 03:36.740]  You know, an ID number.
[03:36.740 --> 03:40.840]  Anything that is directly correlated to you is classified as PII.
[03:41.080 --> 03:43.900]  So we'll talk about some of this later on.
[03:43.920 --> 03:46.340]  And we'll also be talking about some Privacy Acts, too,
[03:46.340 --> 03:48.040]  and what that actually is.
[03:48.300 --> 03:50.640]  It's essentially a...
[03:50.640 --> 03:54.040]  A Privacy Act essentially governs how our data is collected,
[03:54.040 --> 03:55.380]  how our data is controlled.
[03:55.380 --> 03:58.480]  It's dependent by state, dependent by country.
[03:59.900 --> 04:03.300]  And every single state, county, country
[04:03.300 --> 04:05.820]  is going to have slightly different Privacy Acts as well.
[04:06.880 --> 04:08.400]  So, level zero.
[04:11.920 --> 04:15.720]  Okay, so where are we at in our privacy today?
[04:15.720 --> 04:18.140]  Where is our privacy at?
[04:18.280 --> 04:21.840]  The first thing that I'd like to say is if it actually does exist,
[04:21.840 --> 04:24.120]  if this information exists, it can be found.
[04:24.380 --> 04:27.660]  It's not, it can't be found, it's when will it be found.
[04:27.680 --> 04:29.760]  You can always find information,
[04:29.760 --> 04:32.540]  but it might not be from, you know, it may not be available now,
[04:32.540 --> 04:34.660]  but it will at some point become available.
[04:34.660 --> 04:37.640]  Maybe it just takes that specific data breach to happen.
[04:38.100 --> 04:41.280]  And so that information is always going to be available at some point.
[04:41.400 --> 04:43.300]  There's actually a funny thing that's kind of happening,
[04:43.300 --> 04:46.340]  is even though we're in that kind of digital information age,
[04:46.340 --> 04:51.980]  even though we're all aware of privacy, of social media, of those risks,
[04:51.980 --> 04:56.340]  despite all of that, our footprints are actually becoming larger and larger.
[04:56.400 --> 04:59.080]  It sounds kind of intuitive, but that's actually what's happening.
[04:59.080 --> 05:02.320]  There's more social media platforms being created every day,
[05:02.320 --> 05:04.160]  more things for signing up for.
[05:04.160 --> 05:06.880]  These days you have to sign up for everything and, you know,
[05:06.880 --> 05:09.320]  people are signing up for all sorts of different things
[05:09.320 --> 05:12.160]  just to get access to services or things.
[05:12.160 --> 05:14.120]  Things that you didn't actually have to sign up for,
[05:14.120 --> 05:17.100]  you now have to sign up for and give them your information to do so.
[05:17.300 --> 05:21.300]  This comes at a risk because it's actually way easier now for attackers
[05:21.300 --> 05:24.140]  or just anyone really to leverage that information,
[05:24.140 --> 05:27.180]  not even attackers, but just people that are performing OSINT
[05:27.180 --> 05:32.560]  or want to find information, can relatively find that relatively easy now.
[05:32.580 --> 05:36.360]  So, DEF CON reference, whose privacy is it anyway?
[05:37.100 --> 05:41.800]  Privacy is becoming less of a right, unfortunately.
[05:42.200 --> 05:45.080]  You know, obviously privacy will always be a right,
[05:45.080 --> 05:48.940]  but as things are becoming more online,
[05:48.940 --> 05:54.200]  our actual privacy is getting taken away from us.
[05:54.200 --> 05:57.120]  We're less in control of what data we have out there
[05:57.120 --> 06:00.440]  and how that data is actually being used.
[06:01.040 --> 06:03.400]  So, I mean, when you're signing up for things,
[06:03.400 --> 06:05.520]  who knows where that data is going?
[06:06.280 --> 06:08.600]  It can end up anywhere.
[06:09.280 --> 06:13.700]  And the consequences of it is actually very drastic
[06:13.700 --> 06:17.820]  and our privacy is eroding drastically every single year.
[06:18.220 --> 06:21.340]  The thing is, though, organisations love this
[06:21.340 --> 06:23.620]  because they monetise off our data.
[06:24.340 --> 06:26.780]  Data is being sold. Data is being exchanged.
[06:26.780 --> 06:28.280]  Data is becoming a currency.
[06:28.380 --> 06:31.740]  There is now a stage where data is actually more important
[06:31.740 --> 06:34.240]  and valuable than actual money itself,
[06:34.240 --> 06:36.100]  because you can exchange information.
[06:36.240 --> 06:39.160]  Things that organisations want is data and information.
[06:39.160 --> 06:43.040]  And so our data and information is incredibly valuable to organisations.
[06:43.620 --> 06:46.220]  And so the thing is that it's kind of difficult for us
[06:46.220 --> 06:48.480]  is we know how to do the OSINT.
[06:48.480 --> 06:50.000]  We know how to find the data.
[06:50.000 --> 06:54.740]  But because of the nature of organisations wanting to keep this data,
[06:54.740 --> 06:57.360]  there's not really much information about how to actually remove this data
[06:57.360 --> 06:59.040]  and where this data is actually going.
[06:59.540 --> 07:01.960]  So this is going to be kind of jumping into
[07:01.960 --> 07:03.980]  how to take back control of your data
[07:03.980 --> 07:07.280]  and understand where your data is going and how it's being used.
[07:13.600 --> 07:15.780]  OK, so the first thing you actually want to do...
[07:15.780 --> 07:17.600]  I'm going to break this down into different steps.
[07:18.660 --> 07:20.680]  And, yes, I love Game of Thrones as well.
[07:21.100 --> 07:25.420]  You actually want to identify your comfortability levels.
[07:25.600 --> 07:27.140]  And this is really important,
[07:27.140 --> 07:30.100]  because it's going to be unique to each person.
[07:30.180 --> 07:31.660]  There's going to be some people in this room
[07:31.660 --> 07:33.680]  that don't want people to know their name.
[07:33.740 --> 07:35.060]  And there's going to be some people in this room
[07:35.060 --> 07:37.080]  who are OK with putting their name out there.
[07:37.140 --> 07:41.540]  And so it's totally up to you what information you feel comfortable with.
[07:41.540 --> 07:42.740]  But you've got to start there.
[07:42.740 --> 07:47.400]  You have to know what is OK out there and what you don't want out there.
[07:47.400 --> 07:49.900]  So identifying, do you want your email address out there?
[07:49.900 --> 07:51.600]  Do you want your phone number out there?
[07:51.740 --> 07:53.900]  Who are you OK giving this information to?
[07:53.900 --> 07:56.400]  And who are you not OK giving this information to?
[07:56.540 --> 07:59.400]  In a Blue Team term, we would call this like a scope.
[07:59.400 --> 08:00.700]  And essentially this is what we're doing.
[08:00.700 --> 08:02.160]  We're scoping a project.
[08:03.580 --> 08:06.160]  And so we want to set ourselves a scope.
[08:06.180 --> 08:09.140]  We want to know and work out and sit down and brainstorm.
[08:09.380 --> 08:12.020]  OK, well, I don't want my social security number being out there,
[08:12.020 --> 08:13.860]  but I don't mind if people know my name.
[08:13.860 --> 08:16.840]  And once you kind of have that distinction,
[08:16.840 --> 08:19.140]  it's very clear what you need to remove.
[08:19.140 --> 08:20.660]  Until you've identified that,
[08:20.660 --> 08:22.480]  you don't actually know what you need to remove.
[08:23.280 --> 08:25.640]  So that's where you need to go, what is OK to be public?
[08:25.920 --> 08:29.520]  And once I said it's going to be dependent on you,
[08:29.520 --> 08:33.320]  what your role is, how public you want to be,
[08:33.320 --> 08:36.440]  and every single person in this room is going to be totally different.
[08:36.540 --> 08:39.060]  So if one person doesn't want to reveal their name,
[08:39.060 --> 08:40.320]  that's totally fine, up to them.
[08:40.360 --> 08:43.160]  But it doesn't mean you don't have to, it's totally up to you.
[08:43.160 --> 08:45.700]  And then working out what information crosses that line
[08:45.700 --> 08:49.700]  and documenting that and being aware of that information.
[08:55.140 --> 08:57.280]  OK, this might be the most important slide I talk about,
[08:57.280 --> 08:59.120]  so please do pay attention to this.
[08:59.140 --> 09:01.800]  Please create separation.
[09:02.880 --> 09:05.900]  I will repeat that. Please create separation.
[09:05.900 --> 09:07.900]  And what I'm referring to, I mean your separation
[09:07.900 --> 09:11.220]  between your work profile and your online profile,
[09:11.220 --> 09:12.820]  your personal profile.
[09:13.080 --> 09:15.080]  That is really, really important.
[09:15.080 --> 09:19.340]  Because let's just say you have ten social accounts.
[09:19.760 --> 09:22.440]  Five of them are work, five of them are personal.
[09:22.680 --> 09:26.080]  If you use your personal information for all ten,
[09:26.080 --> 09:29.400]  you now have doubled your footprint for no reason.
[09:29.580 --> 09:33.480]  If you use your work information, which is already publicly accessible,
[09:33.480 --> 09:35.560]  because it's probably on your LinkedIn page,
[09:36.060 --> 09:39.020]  and then you use your personal information for your personal stuff,
[09:39.020 --> 09:40.520]  you have just halved your footprint.
[09:41.360 --> 09:45.180]  So things like using your work email for things that you would use for work,
[09:45.180 --> 09:47.760]  using your work mobile for things you would use for work,
[09:47.760 --> 09:50.420]  creating that separation is so important,
[09:50.420 --> 09:53.710]  not just from a stance of an individual,
[09:54.060 --> 09:56.140]  but also from the stance of an organisation.
[09:56.280 --> 09:59.780]  Organisations should encourage their employees to create separation.
[10:01.000 --> 10:03.160]  And once again, you have to kind of identify
[10:03.660 --> 10:07.360]  what is actually used for work and what is not used for work.
[10:07.360 --> 10:10.880]  A good example of this would be, say, for instance,
[10:10.880 --> 10:12.460]  if you were to be in a data breach,
[10:13.160 --> 10:16.240]  and your work account gets breached,
[10:16.240 --> 10:18.800]  but you've used your work email address,
[10:18.800 --> 10:21.620]  you've used your work address,
[10:21.620 --> 10:23.700]  which is on their website footer anyway,
[10:23.700 --> 10:25.820]  and you've used your work mobile number,
[10:25.820 --> 10:28.680]  the level of risk is relatively minimal.
[10:28.900 --> 10:32.000]  And then it would be up to your organisation to determine what to do,
[10:32.000 --> 10:35.980]  because you work for them and then you can notify them that,
[10:35.980 --> 10:38.940]  that kind of creates that separation
[10:38.940 --> 10:43.940]  between what you're responsible for in terms of your data.
[10:44.460 --> 10:46.280]  Whereas your personal information,
[10:46.280 --> 10:49.520]  you can then also do the same sort of thing,
[10:49.520 --> 10:52.480]  use your personal emails, use your personal information there,
[10:52.480 --> 10:55.120]  but having that separation is just super important.
[10:55.700 --> 10:57.900]  Minimises the footprint literally by half,
[10:57.900 --> 11:00.620]  depending on how many accounts you have, what you use for work.
[11:00.620 --> 11:02.900]  I know when I was going through my stuff,
[11:02.900 --> 11:04.900]  I used so many work accounts, and I'm like,
[11:04.900 --> 11:07.260]  oh yeah, okay, I literally just halved my footprint,
[11:07.260 --> 11:10.260]  just like that, and it was, you know, drastic.
[11:10.520 --> 11:12.380]  So I do encourage, if you're an individual,
[11:12.380 --> 11:14.960]  do take this initiative, and if you're an organisation,
[11:14.960 --> 11:18.360]  please do encourage your employees to take this initiative too.
[11:24.600 --> 11:26.760]  And also evaluating your public presence.
[11:26.760 --> 11:29.620]  This may seem obvious, but there's a lot of people that actually don't do this.
[11:30.240 --> 11:32.720]  You need to know what data is out there about you
[11:32.720 --> 11:35.640]  to actually be able to identify what you need to remove.
[11:35.840 --> 11:37.840]  And the thing is with this,
[11:37.980 --> 11:40.480]  a bit of cognitive bias will come into play here.
[11:40.580 --> 11:42.720]  So yes, you can do it yourself, of course,
[11:42.720 --> 11:44.640]  but I do recommend actually someone else doing it,
[11:44.640 --> 11:47.620]  like a friend, someone like that, who you trust,
[11:47.620 --> 11:50.100]  because you're going to know where your information is,
[11:50.100 --> 11:53.460]  and you may actually also not look in places that other people might.
[11:54.280 --> 11:56.220]  And so that is actually the best way,
[11:56.220 --> 11:59.980]  is you do your own kind of OSINT on yourself,
[11:59.980 --> 12:02.980]  and then get a good friend to also do some OSINT on you too.
[12:02.980 --> 12:06.280]  So you have two sets of data,
[12:06.280 --> 12:09.320]  and you can work out, OK, well, this is what is actually out there about me.
[12:09.580 --> 12:13.540]  If you're an organisation, you can actually hire people to do this for you.
[12:13.720 --> 12:16.000]  And this really gives you general awareness
[12:16.000 --> 12:19.480]  of the type of data that is out there about you or your organisation.
[12:20.120 --> 12:22.600]  You can't really... you know, you can't really...
[12:22.600 --> 12:23.580]  It's kind of like a pen test.
[12:23.580 --> 12:26.020]  You have to do the pen test first to know how to fix it.
[12:26.640 --> 12:28.040]  It's the same kind of concept.
[12:28.040 --> 12:31.320]  You have to understand what is out there, what the risk is,
[12:31.320 --> 12:33.580]  and where people are getting this information from
[12:33.580 --> 12:35.240]  to then mitigate against it.
[12:48.110 --> 12:49.610]  So we've done some talking here.
[12:49.610 --> 12:52.090]  I've gone through a few actionable steps.
[12:52.370 --> 12:55.190]  You know, we've spoken about you actually need to create the separation.
[12:55.190 --> 12:57.350]  You need to identify what you're comfortable with.
[12:57.550 --> 12:59.550]  You need to do some OSINT on yourself.
[12:59.630 --> 13:03.410]  But what we're actually here to talk about is more deeper than that.
[13:03.410 --> 13:06.470]  How do we actually go about removing our data?
[13:06.470 --> 13:08.370]  This is the stuff you guys are probably here for.
[13:08.950 --> 13:10.650]  And we're going to answer that.
[13:10.830 --> 13:12.890]  And so please do be patient with this,
[13:12.890 --> 13:14.430]  because it is a little bit of a lengthy process
[13:14.430 --> 13:17.350]  in the way that things actually get broken down
[13:18.150 --> 13:21.410]  and how we actually have to go about doing this.
[13:25.400 --> 13:26.500]  Data brokers.
[13:26.500 --> 13:28.400]  Love data brokers. No, I don't.
[13:29.240 --> 13:32.180]  Okay, so opting out of data brokers
[13:32.180 --> 13:35.760]  is something that I really recommend to everyone.
[13:36.140 --> 13:39.660]  This is just a small list of data brokers,
[13:39.660 --> 13:43.360]  but things like Experian, Equifax, LexisNexis,
[13:43.360 --> 13:45.700]  TransUnion, Axiom, CoreLogic,
[13:45.700 --> 13:50.220]  they are kind of what I call the top data brokers.
[13:50.220 --> 13:52.580]  That's where most people are getting their data from.
[13:52.580 --> 13:57.780]  This could be things like marketing campaigns, ads,
[13:57.780 --> 13:59.900]  people, you know, when you get those people that send you mail
[13:59.900 --> 14:02.600]  that's like, you've been qualified for $1,000.
[14:03.480 --> 14:06.000]  Yeah, this is where they're getting that information from.
[14:06.340 --> 14:08.700]  So opting out at the top level
[14:08.700 --> 14:11.040]  is going to be the most successful thing.
[14:11.280 --> 14:15.140]  And it's a bit of a slow process, because they don't make it easy.
[14:15.140 --> 14:16.180]  They want your data.
[14:16.180 --> 14:18.480]  This is the problem we have with privacy today,
[14:18.480 --> 14:21.280]  is they want your data because they monetize off it.
[14:21.300 --> 14:24.560]  And so they make it as difficult as they possibly can.
[14:24.980 --> 14:27.880]  I have been through this process multiple times.
[14:28.220 --> 14:31.480]  I recommend it, but you do have to be patient with it.
[14:31.520 --> 14:36.520]  It is something that does work, but it does take time.
[14:36.520 --> 14:37.640]  It isn't immediate.
[14:37.640 --> 14:40.280]  You might not see any real results for six months,
[14:40.660 --> 14:43.020]  but you will eventually notice that your footprint
[14:43.020 --> 14:44.540]  is becoming smaller and smaller.
[14:44.540 --> 14:48.520]  You will start getting less junk mail, less spam, less phone calls,
[14:48.520 --> 14:51.980]  things like that, because that data is no longer available.
[14:51.980 --> 14:53.740]  Unless, of course, they're updating it again,
[14:53.740 --> 14:55.660]  if they're getting it from another data broker.
[14:55.760 --> 14:56.460]  Sometimes.
[14:58.040 --> 14:59.800]  So, yeah, you really want to start at the top.
[14:59.800 --> 15:01.780]  You want to start at the top of the food chain,
[15:01.780 --> 15:04.140]  which is with the main data brokers.
[15:04.200 --> 15:06.700]  Another one on this list that I didn't mention is Oracle.
[15:07.040 --> 15:10.420]  I didn't know they actually had a whole entire data broker business
[15:10.420 --> 15:12.240]  until recently, and I was like, oh, wow, that's wild.
[15:12.240 --> 15:15.260]  But, yeah, they actually make a bunch of money on data broking.
[15:15.460 --> 15:17.120]  So that's another one on the list.
[15:17.120 --> 15:19.860]  And I will actually have some resources that I will distribute
[15:19.860 --> 15:23.320]  after this talk, along with obviously the slides and things like that,
[15:23.320 --> 15:27.000]  with a long kind of to-do list for everyone that is actionable
[15:27.500 --> 15:30.120]  with these links and resources and things, too.
[15:30.320 --> 15:33.020]  So once you've actually gone through and opted out of them,
[15:33.020 --> 15:34.780]  how do we actually go about doing that?
[15:35.800 --> 15:41.220]  One thing that you can actually do is every single of these sites
[15:41.220 --> 15:43.800]  and data brokers will have a privacy policy, I would hope.
[15:44.320 --> 15:48.200]  You can actually go into that privacy policy, and you can just kind of do
[15:48.200 --> 15:52.720]  like Control-F and filter for keywords like delete, remove,
[15:52.720 --> 15:57.680]  until you find the section where it gives you the opt-out functions.
[15:58.100 --> 16:03.220]  I know when I did this with, I think it was Equifax,
[16:03.220 --> 16:06.320]  there was about six different opt-out forms I had to fill out.
[16:06.560 --> 16:08.500]  As I said, they don't make it easy.
[16:08.500 --> 16:11.660]  They make it incredibly difficult because they want your data.
[16:12.500 --> 16:16.320]  And so opting out is a bit of a process here.
[16:16.380 --> 16:21.300]  But the other thing as well is that will overall filter
[16:21.300 --> 16:24.240]  into making your footprint smaller.
[16:25.940 --> 16:27.100]  Yes.
[16:34.630 --> 16:36.930]  Now we're going to talk about data collectors,
[16:36.930 --> 16:42.570]  which also goes hand-in-hand with the opt-out process for data brokers.
[16:42.570 --> 16:46.090]  I want to just call out here that the FCC resources,
[16:46.090 --> 16:47.370]  they are not a data collector.
[16:47.610 --> 16:49.530]  I just want to make that really, really clear.
[16:49.530 --> 16:52.610]  They actually have a fantastic resource on their website
[16:52.610 --> 16:57.690]  that lets you opt-out of like marketing call communications.
[16:58.130 --> 17:02.470]  They put you on like a do-not-sell list, essentially,
[17:02.470 --> 17:06.430]  and over time when people kind of fetch this list,
[17:06.430 --> 17:07.990]  you will not be on there.
[17:07.990 --> 17:13.810]  So they kind of push that out on a bit more of a US-wide scale.
[17:13.810 --> 17:18.710]  I really recommend that because they have you on like a do-not-call list,
[17:18.710 --> 17:20.930]  do-not-email list, do-not-mail list,
[17:20.930 --> 17:24.330]  and there's actually a bunch of different sub-sections
[17:24.330 --> 17:28.950]  on the FCC site that you can actually opt-out from.
[17:29.310 --> 17:32.370]  And they're very granular and specific about what you can
[17:32.370 --> 17:34.910]  and can't opt-out of, and they make it very clear and simple.
[17:34.910 --> 17:37.830]  But another thing, as well, is internet providers.
[17:38.190 --> 17:43.490]  I wanted to also specify that opting out does not stop the service.
[17:43.570 --> 17:46.730]  If you opt-out of something, if you're opting out of like Equifax,
[17:46.730 --> 17:49.790]  TransUnion, credit reporting bureaus,
[17:49.790 --> 17:51.530]  you're not deleting your credit score,
[17:51.530 --> 17:54.390]  you're not removing your credit score data.
[17:54.390 --> 17:55.230]  That still exists.
[17:55.230 --> 17:57.630]  It doesn't impact your credit score or any of those sort of things.
[17:57.630 --> 17:59.150]  So I think there's a bit of a misconception there.
[17:59.150 --> 18:01.050]  I want to just clarify with everyone.
[18:01.210 --> 18:04.090]  What you're essentially opting out of is opting out for them
[18:04.090 --> 18:07.810]  to use your data for monetary purposes or to trade
[18:07.810 --> 18:11.150]  or whatever transactional purpose they use your data for,
[18:11.150 --> 18:13.190]  whether it's monetary or for another purpose
[18:13.190 --> 18:16.790]  or for another marketing campaign or organisation.
[18:18.010 --> 18:19.270]  Same with internet providers.
[18:19.270 --> 18:20.850]  Opting out doesn't stop your service.
[18:20.850 --> 18:22.930]  You're not deleting your account per se.
[18:22.930 --> 18:26.070]  You're just telling them, hey, you can't use my data anymore,
[18:26.750 --> 18:28.850]  and they should be cool with that.
[18:29.350 --> 18:31.890]  Phone providers, people search sites.
[18:31.890 --> 18:35.330]  I tend to call these the bottom feeders, I guess,
[18:35.330 --> 18:37.210]  because you have the top data brokers,
[18:37.210 --> 18:41.030]  and then you have these guys where they get a lot of their information from,
[18:41.030 --> 18:43.810]  but they also collect information, so therefore they're in the middle
[18:43.810 --> 18:45.930]  and they also distribute information.
[18:46.770 --> 18:48.070]  Rewards programs.
[18:49.050 --> 18:51.050]  I have a funny story.
[18:51.050 --> 18:55.330]  I moved to the United States four years ago,
[18:55.890 --> 18:57.950]  and when I moved here, I thought it would be cool
[18:57.950 --> 18:59.390]  to sign up for a bunch of reward programs
[18:59.390 --> 19:01.670]  because I wanted to feel like I belonged here.
[19:01.790 --> 19:03.850]  So I was like, yeah, sure, I'll sign up with Kroger.
[19:04.050 --> 19:05.330]  So much regret.
[19:06.430 --> 19:10.670]  The thing with rewards programs is they kind of try to convince you
[19:10.670 --> 19:12.910]  that you're going to get something beneficial from it,
[19:12.910 --> 19:16.630]  like $5 every three months, but you kind of got to think,
[19:16.630 --> 19:20.330]  okay, is it actually worth them having my data?
[19:20.730 --> 19:23.510]  Do I need a Kroger account? Do I need a Publix account?
[19:23.510 --> 19:26.210]  Is there a functional service that they're offering me
[19:26.210 --> 19:27.990]  where I need an account for?
[19:27.990 --> 19:30.630]  And kind of going through that and understanding,
[19:30.630 --> 19:34.250]  okay, like Dick's Sporting Goods, do I need an account for that?
[19:34.250 --> 19:36.110]  Maybe you do, maybe you don't. Up to you.
[19:36.110 --> 19:41.710]  And this goes back to understanding what you want out of your data privacy
[19:41.710 --> 19:43.450]  because everyone's going to have individual goals
[19:43.450 --> 19:44.930]  on what they're trying to achieve.
[19:45.270 --> 19:47.590]  For me, I went through and I deleted so much stuff.
[19:47.590 --> 19:48.650]  It was fantastic.
[19:48.650 --> 19:51.230]  And I'm like, yay, I'm free of the rewards programs.
[19:52.070 --> 19:56.330]  So yeah, working out what you're wanting to have out of that or not.
[19:57.990 --> 20:01.330]  The thing as well is sometimes when you sign up for things
[20:01.330 --> 20:05.810]  at the bottom of the sign-up screen where they say like,
[20:05.810 --> 20:09.430]  yes, I agree to the privacy policy,
[20:09.430 --> 20:11.030]  check what's actually in the privacy policy
[20:11.030 --> 20:16.810]  because they may not actually state in the line there
[20:16.810 --> 20:18.350]  that they're selling you information.
[20:18.350 --> 20:20.090]  Some places will actually have it separate,
[20:20.090 --> 20:23.470]  but it's dependent on how their legal team has done it, to be honest.
[20:24.530 --> 20:26.750]  Some places you can actually check like,
[20:26.750 --> 20:28.450]  yes, I agree to terms and conditions,
[20:28.450 --> 20:33.350]  but no, you can't keep my information for marketing purposes.
[20:33.530 --> 20:36.190]  But then some will just have like one where it's all just clustered in together.
[20:36.190 --> 20:38.250]  So if you're accepting to use their service,
[20:38.250 --> 20:40.930]  you could just be accepting everything collectively.
[20:41.550 --> 20:45.150]  So you also got to kind of weigh out the pros and cons of that too
[20:45.150 --> 20:48.830]  as an individual and work out, is that something that you want to risk?
[20:48.830 --> 20:50.630]  Is that a service I really need?
[20:50.630 --> 20:54.190]  How much exposure is this going to provide, you know,
[20:54.190 --> 20:55.890]  my information out there to the world?
[20:56.630 --> 20:59.850]  Same with, you know, phone providers are notorious for sharing information,
[20:59.850 --> 21:01.650]  as I'm sure we all know.
[21:02.210 --> 21:03.670]  People search sites.
[21:05.510 --> 21:08.070]  They collect information and they share it
[21:08.070 --> 21:10.270]  and you can pay for information and things like that too,
[21:10.270 --> 21:14.110]  but they get a lot of that from collectively everyone else
[21:15.070 --> 21:17.510]  and also historical records as well.
[21:17.710 --> 21:20.310]  One thing that I actually did not add on this slide,
[21:20.310 --> 21:22.950]  but I wanted to mention, is county records.
[21:23.170 --> 21:27.630]  You can actually go to your county or whatever counties you have lived in
[21:27.630 --> 21:30.490]  and you can actually request everything they have on you.
[21:30.790 --> 21:32.050]  That is totally allowed.
[21:32.050 --> 21:36.970]  They have to give you everything that they have or any sort of records.
[21:37.310 --> 21:41.690]  It's kind of like a FOIA request, but for just you in your county.
[21:41.830 --> 21:44.510]  They'll give you whatever records they can provide
[21:44.510 --> 21:48.190]  and then some records they'll even let you redact it as well.
[21:48.190 --> 21:53.010]  It's dependent on what their county and state laws are,
[21:53.010 --> 21:55.870]  so I can't be too specific around it,
[21:55.870 --> 21:58.230]  but you want to check with them on what can actually be redacted.
[21:58.230 --> 22:01.290]  So if you're really wanting to go gung-ho on this
[22:01.290 --> 22:05.150]  and really hide everything, that might be an option for you,
[22:05.150 --> 22:07.210]  is checking with your county records.
[22:13.640 --> 22:16.320]  Okay, the actual data removal process.
[22:16.900 --> 22:18.480]  This might sound kind of intuitive,
[22:18.480 --> 22:20.620]  but you actually want to start with your password manager.
[22:20.620 --> 22:22.800]  And this is a great place to start with
[22:22.800 --> 22:25.900]  because it gives you a record of everything you have access to.
[22:26.220 --> 22:30.520]  So it's essentially a log for all the sites you've signed up for.
[22:30.920 --> 22:32.280]  So you want to start there.
[22:32.700 --> 22:35.960]  I did it in alphabetical order because that worked for me.
[22:36.280 --> 22:39.120]  And as I said, it's a bit of a lengthy process.
[22:39.500 --> 22:41.840]  But you can literally just go site by site by site
[22:41.840 --> 22:44.500]  and go, do I need this? Yes, no.
[22:44.500 --> 22:46.500]  Log in, delete the account.
[22:46.940 --> 22:49.460]  There's a few different ways you can actually delete accounts.
[22:49.460 --> 22:53.160]  Some places will actually let you log in directly
[22:53.160 --> 22:55.440]  and delete the account, which is great.
[22:55.520 --> 22:58.160]  Clap to them if they do that because that's fantastic.
[22:58.880 --> 23:02.080]  Some places you have to actually go into their privacy policy
[23:02.080 --> 23:07.800]  and actually do an account deletion request via that.
[23:08.320 --> 23:09.860]  And then there are a couple of sites I've come across
[23:09.860 --> 23:12.560]  where they don't let you delete that unless you email them.
[23:13.480 --> 23:14.820]  So there's that too.
[23:14.820 --> 23:16.960]  And you can email them and usually they're pretty responsive
[23:16.960 --> 23:20.940]  and they can go ahead and do that deletion request for you.
[23:21.020 --> 23:23.380]  But this is essentially a great place to start
[23:23.380 --> 23:25.980]  when you're looking at how do I actually remove my footprint.
[23:25.980 --> 23:27.960]  Start with the accounts you already have access to,
[23:27.960 --> 23:29.820]  the things you already signed up for,
[23:29.820 --> 23:32.900]  because this is going to help everything in the future
[23:32.900 --> 23:35.760]  and help overall minimise your existing footprint.
[23:37.160 --> 23:38.620]  Conduct regular maintenance.
[23:38.740 --> 23:41.160]  The first time you do this, it's going to take a while
[23:41.160 --> 23:43.760]  and we'll kind of talk about some timeframes and things overall
[23:43.760 --> 23:46.320]  on one of the upcoming slides.
[23:46.320 --> 23:49.200]  But once you do this, it only takes about once a year,
[23:49.200 --> 23:53.360]  like an hour, two, maybe three hours a year
[23:53.360 --> 23:55.980]  to kind of keep this maintained.
[23:55.980 --> 23:59.280]  In the grand scheme of things, that's actually not really a lot of time.
[23:59.980 --> 24:02.260]  So that is something that I do recommend,
[24:02.260 --> 24:03.760]  is just sitting down once a year
[24:04.140 --> 24:07.860]  and just kind of going over all your accounts you signed up for in the past year.
[24:08.220 --> 24:11.320]  The first time I did this...
[24:11.320 --> 24:11.800]  Sorry.
[24:13.720 --> 24:18.480]  The first time I did this, I had a bunch of accounts.
[24:18.600 --> 24:19.780]  It took a while.
[24:20.440 --> 24:24.740]  But now that I've actually done it, it's pretty easy to maintain.
[24:24.740 --> 24:27.120]  It's no longer a challenge, no longer a chore.
[24:27.120 --> 24:30.260]  I'm a lot more aware now about what to do moving forward.
[24:42.660 --> 24:45.240]  But wait, guys, there's more. It's a sales pitch and I'm joking.
[24:46.160 --> 24:47.440]  Browser cookies.
[24:47.440 --> 24:53.640]  Similar to how organisations are wanting to have all your data,
[24:53.640 --> 24:54.920]  so are browser cookies.
[24:54.920 --> 24:59.360]  By default, a lot of sites, not all of them, but a lot of sites,
[24:59.360 --> 25:02.600]  when you click that allow all cookies button,
[25:02.600 --> 25:05.560]  you're literally just saying, hey, yeah, have everything.
[25:05.800 --> 25:08.400]  There are some sites that do let you be very specific
[25:08.400 --> 25:10.140]  about the cookies you're giving them.
[25:10.420 --> 25:13.380]  And sometimes you don't even need cookies for the site either.
[25:13.380 --> 25:16.460]  It's kind of just that sense of they...
[25:16.460 --> 25:19.300]  it's almost like a bit of a social engineering tactic.
[25:19.300 --> 25:22.580]  They have a little banner that pops up and it kind of convinces you
[25:22.580 --> 25:26.580]  that you actually need to give them your cookies to access the site,
[25:26.580 --> 25:28.800]  but you don't really need to.
[25:28.920 --> 25:31.620]  It's dependent on the site, of course.
[25:32.240 --> 25:37.140]  But that is just something to be really aware of as well.
[25:38.060 --> 25:39.160]  Alternative emails.
[25:39.160 --> 25:42.040]  I know a bunch of people that do this and I love it.
[25:42.040 --> 25:46.760]  Because when you are in a data breach, you know exactly where it came from.
[25:46.760 --> 25:49.200]  I highly recommend this.
[25:49.600 --> 25:55.220]  I see a bunch of people that will have like eventbrite.handle
[25:55.220 --> 25:59.640]  at blah, blah, blah, blah, blah, or facebook.blah, blah, blah.
[25:59.780 --> 26:04.340]  And so they have a specific alias email that they're giving
[26:04.340 --> 26:06.020]  to that specific entity.
[26:07.200 --> 26:09.960]  If you... I don't know about Android specifically,
[26:09.960 --> 26:14.160]  but if you are an Apple user, given my MacBook, I clearly am.
[26:15.680 --> 26:17.940]  Apple actually has a really cool function embedded
[26:17.940 --> 26:19.660]  where you can actually do this automatically.
[26:20.080 --> 26:22.360]  You don't have to go ahead and create it for you.
[26:22.360 --> 26:23.600]  They do it all for you.
[26:23.600 --> 26:25.780]  It's actually under the iCloud settings.
[26:26.260 --> 26:29.120]  You can actually log in with Apple and they create you different aliases
[26:29.120 --> 26:30.740]  for every single login.
[26:30.920 --> 26:32.180]  I personally love that.
[26:32.180 --> 26:35.740]  I do think it's a great way to easily manage something
[26:35.740 --> 26:39.740]  without having to create each individual email alias yourself.
[26:40.360 --> 26:43.340]  But also it depends on what provider you're wanting to use.
[26:43.340 --> 26:45.820]  If you're wanting to use another email provider,
[26:46.000 --> 26:49.660]  a lot of them offer this as a service for email providers.
[26:50.280 --> 26:51.920]  And changing your data.
[26:52.300 --> 26:57.780]  This is an interesting one because there's so much data out there about us,
[26:57.780 --> 27:01.160]  but it's also... have you ever seen on like Zillow
[27:01.160 --> 27:02.840]  how you can like claim a house?
[27:03.060 --> 27:05.440]  You can like log in like, yep, this is my house.
[27:05.440 --> 27:08.260]  Well, once you do that, you can do whatever you want with that data.
[27:08.320 --> 27:09.880]  Because you've said, yeah, this is my data.
[27:09.880 --> 27:11.340]  I've proven this is my data.
[27:11.620 --> 27:13.160]  I cannot change that data.
[27:14.420 --> 27:16.980]  That's the great way to kind of change what is out there,
[27:16.980 --> 27:19.320]  almost like a little bit of misinformation,
[27:20.100 --> 27:24.780]  is claiming that data and then changing it or removing it
[27:24.780 --> 27:26.360]  or whatever you want to do with that data.
[27:26.360 --> 27:27.720]  Just putting that out there as an option
[27:27.720 --> 27:29.880]  because that might be beneficial to some people.
[27:32.760 --> 27:36.740]  A good example of this would be things like white pages,
[27:36.740 --> 27:38.620]  PeopleLooker, things like that.
[27:38.860 --> 27:40.760]  Obviously, over time, once you've opted out
[27:40.760 --> 27:42.580]  from those kind of top-level data brokers
[27:43.140 --> 27:45.760]  and the bottom feeders are kind of catching up
[27:45.760 --> 27:47.400]  and saying, yep, okay, this data no longer exists.
[27:47.400 --> 27:49.760]  Eventually, you're going to see that that data
[27:50.980 --> 27:52.820]  won't be distributed as much,
[27:52.820 --> 27:55.280]  but it's still going to exist as a historical record
[27:55.280 --> 27:58.940]  on things like PeopleLooker, white pages, things like that.
[27:58.940 --> 28:03.000]  And so that's a great way to actually claim that data
[28:03.000 --> 28:05.340]  and then remove it because you now own that data
[28:05.340 --> 28:06.860]  and you've proven it's yours
[28:06.860 --> 28:09.200]  and now you can take control of that data.
[28:15.730 --> 28:18.190]  Statistics, because who doesn't love statistics?
[28:18.810 --> 28:21.790]  Just a little bit of info about the whole data broking,
[28:21.790 --> 28:23.070]  selling information.
[28:23.150 --> 28:26.130]  What I'm referring to is organizations,
[28:26.130 --> 28:28.170]  and so many organizations do this.
[28:28.170 --> 28:30.470]  They buy and they sell and they trade information
[28:30.470 --> 28:31.590]  from each other.
[28:31.670 --> 28:34.050]  As I mentioned, information is incredibly valuable
[28:34.050 --> 28:35.250]  in OSINT.
[28:35.950 --> 28:38.050]  It's valuable to all organizations,
[28:38.650 --> 28:40.790]  things like marketing organizations,
[28:40.790 --> 28:42.130]  things like that, too.
[28:42.650 --> 28:45.170]  Just in 2022 alone,
[28:45.170 --> 28:49.170]  it is a $300 billion industry.
[28:49.370 --> 28:51.690]  Yes, selling your data is an industry.
[28:52.770 --> 28:54.970]  There are actually projections out there
[28:54.970 --> 28:58.190]  by brokers where they're actually estimating
[28:58.190 --> 29:00.410]  that by 2020...
[29:00.410 --> 29:02.130]  Actually, I think I typed that wrong.
[29:02.130 --> 29:03.470]  I think it was supposed to be 2030.
[29:03.470 --> 29:05.350]  Yeah, I typed that wrong. My mistake.
[29:05.690 --> 29:09.230]  By 2030, they're estimating $500 billion
[29:10.150 --> 29:13.870]  is the actual estimated value of all of our data.
[29:14.250 --> 29:16.670]  So that goes to show how much our data is worth.
[29:17.490 --> 29:19.570]  But how much is it worth to you guys?
[29:20.310 --> 29:22.610]  Roughly, it would say, on average,
[29:22.610 --> 29:25.090]  about six hours per year is all it's going to take
[29:25.090 --> 29:28.310]  for you to actually do something about it,
[29:28.310 --> 29:30.070]  to minimize your footprint,
[29:30.070 --> 29:33.930]  to take action on some of these things we've spoken about.
[29:33.990 --> 29:36.550]  There's going to be some people who are going to go ahead
[29:36.550 --> 29:38.950]  and do this, and there's going to be some people who don't.
[29:38.950 --> 29:40.270]  So you've kind of got to think about
[29:41.870 --> 29:45.370]  how much time is your privacy actually worth?
[29:46.510 --> 29:50.230]  Because if you go out there and you don't do anything about it,
[29:52.370 --> 29:56.070]  and other organizations have your data and things like that,
[29:56.070 --> 30:01.930]  unfortunately, there is not a way to automate this.
[30:01.930 --> 30:04.910]  It isn't something that you can just go out there
[30:04.910 --> 30:06.750]  and click a button and delete all.
[30:07.530 --> 30:09.430]  And I think that is intentional.
[30:09.550 --> 30:13.170]  I really think that a lot of organizations do that intentionally.
[30:13.490 --> 30:16.150]  So you've got to think about how much time is your privacy worth
[30:16.150 --> 30:21.390]  and spend that kind of time to invest in your own privacy for future.
[30:28.090 --> 30:29.390]  I do have a challenge.
[30:30.390 --> 30:33.370]  Ice cream social challenge.
[30:33.370 --> 30:42.150]  I have the last EFF privacy badger cert bot.
[30:42.150 --> 30:47.290]  My husband and I created this for EFF.
[30:47.290 --> 30:50.170]  There's one left. We have a challenge.
[30:50.170 --> 30:56.250]  The first person that can provide me evidence in a photo form,
[30:56.250 --> 31:00.750]  you need to get strawberry Ben and Jerry's and give it to Zant.
[31:01.250 --> 31:04.330]  Don't ask questions. No questions asked.
[31:06.170 --> 31:08.590]  Whoever can provide me evidence of that,
[31:08.590 --> 31:14.510]  the first person via Twitter, LinkedIn, whatever platform,
[31:14.510 --> 31:17.190]  the first person that can find strawberry Ben and Jerry's
[31:17.190 --> 31:21.110]  and give it to Zant, I'll give you a hint, Zant is a goon,
[31:22.390 --> 31:28.210]  wins the very last one of these privacy badger EFF badges.
[31:30.760 --> 31:32.300]  Thanks, guys.