Data Baby at Latitude – how much would you share?

As part of an ongoing investigation into what happens to our data online, Channel 4 News has found that using simple tools it is possible to uncover a treasure trove of personal information. To make matters worse, many web users seem only too ready to make friends over the internet with people they do not know, exposing them to even more intrusive surveillance.

We created a virtual person called Rebecca Taylor, and have been using her profile to look into how personal info is used and abused online. We used Rebecca’s Facebook account to befriend gig goers heading to the Latitude Festival, and dozens accepted our request, despite the fact Rebecca does not exist.

The fact that you know where we live, and that’s something I’ve not actually put out there publicly, that’s alarming. Mike Sheldrick

We then asked a security researcher to see how much he could find out about Rebecca’s new friends. Using only publicly accessible sources, he helped us unearth home addresses, mobile phone numbers, financial details, as well as snippets of information thought to be long forgotten by those who’d originally posted it online.

“This was all public information, no subscription services or clandestine sources, just areas of the internet that anyone can get access to,” said Glenn Wilkinson of SensePost.

Mike Sheldrick (pictured) was one of them: we had found details of his acting career, information about his fiancée, and unearthed a website he created years ago: something even he thought had disappeared from the web. Most worryingly, we easily found his home address – a home we knew was empty for the duration of the festival.

“The fact that you know where we live, and that’s something I’ve not actually put out there publicly, that’s alarming,” said Sheldrick. “I think it would be good to know how to go back and delete some of those type of details.”

Denzil Ede was DJing at the festival. An old email address for him led us to Princess Zuton, his female alter ego on an online role playing game. “I’m not particularly embarrassed by that,” said Ede, “some characters in role play just end up being female. But the fact that an email address can lead to that makes me think websites could do a better job keeping those email addresses hidden.”

Internet searches for other friends of Rebecca revealed financial details, including records of payments made which had been published online as PDF files.

“People don’t think these bits of information are that important,” said Wilkinson, “but if you put them together than can be a toolkit for identity theft. For example, a lot of online services have a forgotten password function where you’re asked questions instead of entering a password. Often those questions are things like your mother’s maiden name or a pet’s name, and those are easily discoverable online.”

Three things you can do to clean up your online profile:
1. Carry out internet searches for yourself: put quote marks around your name (eg. "Geoff White") to make sure you search your specific name
2. If you find something you want removed, then links can be removed by contacting the search engine (Google, Bing, Yahoo, etc.), but you should also approach the website where the information is published directly
Check your Facebook privacy settings. If your hometown or employer is publicly visible, it can help identify you
(It may help to look at your profile from the Facebook account of someone with whom you’re not friends, so you can see how your profile looks to thee public)
3. When registering to vote, make sure you tick the box to have your name removed from the Edited Register: this will limit the number of people who can look up your address