Your Public Information

Steve
5 min readFeb 12, 2023

--

Your personal information doesn’t need to be part of a data breach to be found on the internet.

The internet is a great joy. It enables us to perform countless hours of research, effortlessly share information with everyone, saves time with managing financials, and maintain relationships with anyone. The internet has it all, can do it all, and we benefit from it all.

One Challenge to Rule Them All

Information is necessary to make decisions. The internet has information and with a little help, you can find what you want or need relatively quickly and easily. The primary challenge with the information on the internet is that it has to come from somewhere. Doesn’t matter if it is found in the comments of a viral post or from a valid news media site, once it is on the internet, it becomes a published source to reference.

Outside of social media sites, there are lots of repositories that contain information about individuals. Stolen information from data breaches, Domain Name System (DNS) registries, tax records, and property ownership are just a few examples of sites that make information searchable. Most of these sites don’t even require an account to search that information. Once the information is on the internet, it is accessible by anyone.

The Internet Doesn’t Forget

Social media sites like Facebook, YouTube, and Reddit connect individuals together. Within those sites, individuals with similar interests can form subcommunities sharing perspective, information, pictures, or videos. Once you post a comment, picture, or video to these sites, you’ve released all control of your information to that site. While they do offer the ability to remove or delete posts, you’ve still transfered your data (files or text) to another entity who essentially controls that information.

Stolen information from data breaches usually ends up on the internet. Depending on the information, the most common location can be on a hackers forum, ransowmare leak site, or other commonly referenced repository (GitHub, PasteBin, etc.). Once on one of these publicly accessible sites, the information can be downloaded by anyone.

DNS is the “phone book” of the internet. Individuals or businesses can buy domains to setup websites or email addresses. DNS how computers route traffic from human readable words (locohostcyber.com) to IP addresses in order to display the correct information in the web browser. When a domain is registered, the registrant information then becomes public record (unless they pay more for anonymizing the entry).

Most state and local municipalities make their land ownership or personal property records public. Anyone can navigate to the municipalities website, search for a specific address or by an individuals name, and pull up records that could include first and last name, address, phone number, and tax payment status.

DNS, state, and local municipalities have replicated online the same features we’ve grown accustom to before the rise of the internet. The phone company would publish phone books and deliver them to their subscribers annually. Town records are available to individuals who walk into town hall to request access to information. The primary difference is the internet’s reach is vast, enabling access to this information by many more people whereas town records or phone books were easily accessed by residents of the same area.

Open-Source Information: People Search Engines

For all those who have “googled” themselves, they know that their name and potentially much more information is available, especially for those individuals who frequently author blogs, publicly speak, or adverstise their information. For the rest, if you haven’t googled yourself, then by all means do it. You never know what information is contained within these search engines if you don’t see for yourself.

Pro tip: don’t just search google.com. Be sure your search includes the major search engines google.com, bing.com, duckduckgo.com, and yahoo.com

For the real spice, if the main search engines don’t return any results, don’t feel relieved just yet. There are websites who are classified as “people search engines” that index and aggregate information about individuals. These sites contain almost the same amount of information as background checks. In fact, most of these sites offer the ability to conduct a background check.

Information like current and previous addresses, associated phone numbers, potential relatives, email addresses, and even VIN information. These sites offer point and click searches of anyone to anyone. If you don’t believe me, try it for yourself:

These three sites are the more popular sites, but this list isn’t final. There’s a lot of these people search engines out there and more coming online every several months.

They Have My Info, Now What?

These sites may contain a lot or a little information about you. Regardless, if you don’t want them to host it, then you’ll need to contact them to have it removed. Many of these sites have specific requirements to remove these records. The optout links are provided below, but be sure to familiarize yourself with each sites specific process.

Removal of your information is site dependent. Thatsthem.com estimates 5–7 days to remove. Truepeoplesearch.com estimates several hours to complete. Be sure to verify your information has been removed after the estimated time period has elapsed.

Opting out of each site should remove your information from that site. HOWEVER, and this is a big however, your information will still exist in the original location that the site indexed. This means that while you’ve removed it from one location (the people search engine), it will still exist within the original record (DNS registrant record, tax record, etc.). You will need to monitor these people search engines periodically to ensure your information is removed and continues to be removed. You could also try contacting the original source (should you identify it) and ask they remove it as well.

Summary

Your information exists on the internet regardless if you were part of a data breach. You just have to know how to find it. There’s a lot of information repositories that are made available to the public through state and local governments. These repositories are indexed by third-party sites and information about you is aggregated then easily searched for free. Be sure to control your information as much as possible and opt out of these sites who are making your private information searchable.

--

--

Steve

Cybersecurity evangelist and cybercrime investigator who has investigated over thousands of events with ransomware, insider threat, and regulatory inquiries.