Joe Stephenson is managing director of SIU at Hagerty and Social Media & Online Investigations Expert. At FRAUDtalks 2018 in Amsterdam he warned about the double-edged sword of social media data – how it can help both investigations and criminals.
Privacy in social media
Would you put your banking information on Google? Your bank statement? How much you owe your credit card company? Do you want people to know every single thing about you? Do you want them to know that you are attending this conference here right now? How much you paid for your train ticket or where you had breakfast?
People place personal information online every day and the younger generation is doing it more and more. Privacy in social media is very precious. But it is a double-edged sword for those of us that are in the investigation industry. As we see the value of all this data, we can use it. But we also know it can be used against us. Because if criminal organizations have an opportunity to target you, to manipulate you, they will.
A whole life online
I would like to tell you a story that happened many years ago. Walking around the campus of California Technical Institute of Pasadena with a friend of mine, we found this young woman’s ID on the ground. It was from a different university. I couldn’t find anyone to give the ID to, so I said: “Oh, let me get on my phone and see if I can find her address and mail the ID back to her.” And in 30 minutes, on my mobile, I found not only her name and address, but everything about her. Where she lived, what the apartment looked like inside, how many cats she had, her boyfriend’s schedule, where she went to yoga classes, where she got her coffee in the morning. I could have easily tracked her. Had I been somebody bad, I could easily have stolen her identity.
Your data up for grabs
We all want to be important, we want to be special. That’s the trouble with people and online privacy. The great part of social media is that it allows us to be bigger than life. To live the life that we want, at least online. We choose to display pictures and information online – including passport information and visa and financial data. It is a double-edged sword. As insurers, as investigators, we use this data for risk assessment and claims investigations. Because the data is there.
Although we choose how to display our data and trust Facebook and Instagram how to store it, we don’t get to choose how to it is repurposed. We have no control over where this data has gone, how other people are using it. As investigators we like that, we can take that information and store it for the long term. Trust me, there are many things on the internet we wish we could forget. But removing your data and information does not mean that you are forgotten if somebody else has already captured it and you don’t know about it.
It’s the others
What about other people posting about you on the internet? I do not post a lot on Facebook. My wife posts everything on Facebook and Instagram. So while you may go to my profile and not see much, if you know how to manipulate social media, you can find an immense amount of data about me.
It is not just Facebook. It’s also LinkedIn. A few weeks ago I saw this CEO who has 32+ thousand followers on LinkedIn who posts this young gentleman’s resume. And essentially tells people “Hey, I’m willing to post one resume a week for everybody, just put it in the comment section.” No doubt this is a well-intentioned CEO trying to help somebody get a job. But in the comments that followed there are hundreds of resumes listed. With their personal information, some with their date of birth, some with financial information on it, some people even had a PayPal account number listed to it. Here are people who may be jobless, who may be financially strapped and looking for work, willing to give this data out here. And there is no way back, no way to know who has captured your personal information for less well-intended reasons.
Personal is more than your name
By the way: personal data is way more than your name, address or mobile device numbers. It is your favorite TV show, it’s your favorite cafe that you go to every day. Start thinking outside of the norms. Start thinking about how the fact of your favorite cafe could be used to find you and track you online. With a name, an age range and a couple of pieces of information I can find your social media profiles. Even when you are not using your own name out there.
Social media platforms give us control over our privacy settings. But this gives us a false feeling of control. I found the Facebook profile of a man, completely unknown to me until today. He has put a lot of effort into showing no personal information on his profile, just his picture. But he liked his mosque, one single like that was not protected under Facebook. Knowing his mosque, I can find him by searching for all males who like this mosque and comparing the profile pictures. By manipulating the Facebook search, we find everything connected to his profile – photos and posts he is tagged, recommended or listed in. Seeing a picture of a passport and ticket with the destination of the city of my ‘target’, I find a nephew. By looking closely at his surrounding circle of friends and relatives we can fill in the blanks.
This way we, as investigators, can narrow things down, map criminal organizations or see relationships between parties. Or catch people who are stupid enough to post pictures of themselves with the car they stole or the money from the robbery.
Now think about all the things you have liked. All the sports clubs, all the places you have checked in for dinner. Food pictures you took. Do you remember what you liked several years ago? Did you remove that information?
Social media and privacy go hand in hand and privacy is a double-edged sword. You need to be able to understand it, not only know that it exists, but also how to protect yourself. I am happy to share with you all my information and PowerPoints and all the books that I started writing but never finished because they were outdated before I was done, because it is all about sharing information. Learning how to use that data, learning how to find your targets, and learning how to protect yourself and your family. Because you may have nothing to hide, but you have always things to protect.
Also enjoy watching Joe Stephenson’s presentation @ FRAUDtalks 2018.