How to scrub your online footprint?
I don't necessarily want to delete everything there is about me, but I want to significantly clean it. I've been deleting old accounts lately, I've seen some screenshots of my tweets on Reddit and I've asked the authors to delete them. They've been kind enough to do it.
But I feel like there's more that I need to do. I just realized that there are probably a lot of screenshots of YouTube comments and Tweets that I've put out there in the world with my name and face. It wouldn't be so bad if I didn't drastically increase my footprint last year during my time on Twitter.
I'm not a techy person, I was thinking about asking or hiring some type of hacker or expert to help me. Because they could probably find more information about me than me.
Can anyone help?
You.. don't.
Somewhere, everything you have ever posted online is backed up in a database. I'm not talking about shady shit, but expected stuff, like Reddit and Twitter both have backup policies, Google aggressively indexes almost everything unless asked not to, etc.
By default you should assume that anything you post online will never go away. Once you click post or submit, it's out there, for better or worse.
That said, you could try to bury the signal in noise so to speak, but how successful that would be is questionable.
If you want to post stuff, use a random name. For example, I doubt very many people will know this "Bear" from any other bear. You know - Cute as hell, want to cuddle them but would die, etc.
Oh I understand that and I now don’t use my real name on anything. If someone wants dirt on me, however, I want it to be harder than just a google search away. You feel me?
Better late than never, I suppose.
For now, I think that's a pipe dream. Unless we can get something nationwide like the EU's 'Right to be Forgotten', then a good Google may be all that someone needs to get started. It would surely lead to more, of course.
Yep.
There are several facets to this:
I'm going to tackle a few aspects others have neglected.
Seek strong personal privacy and data protection standards. This is an increasingly prevalent discussion and policy in parts of the world, though it's not yet been unified. Europe's GDPR, a smattering of data protection laws in the US (many at the state level), and a few others elsewhere exist. If you're covered by a relevant jurisdiction, seek the maximum protection these laws have to offer. If you're not, advocate for strong data protection and privacy laws where you are.
I've been looking at different conceptualisation than has been common to date, of informational autonomy, a concept that combines elements of free speech, privacy, right to know, and protections from fraud and disinformation. Keep in mind that many of these principles conflict, a fact which is at the core of the concept of informational autonomy: there exist trade-offs between the elements addressed.
For good and more traditional views, I recommend Daniel Solove, Helen Nissenbaum, Phlip E. Agre, Jeffrey Rosen, Warren & Brandeis, Cory Doctorow, Bruce Schneier, Paul Baran, and organisations such as the ACLU, EPIC, EFF, and others.
In particular, legislation and regulation over the collection and exchange of personal information is probably the most useful to pursue. Making information expensive, dangerous, and worthless will vastly reduce incentives to collect, exchange, and analyse it.
Most of the data created by and about you is not publicly available. It comes in the form of "data smog" from credit and debit card purchases, payroll processors, transit cards and tollway tags, Web browser activity, your ISP's tracking, your mobile phone, Internet of Things devices, and more. That's not going to turn up in a Google search but is accessible through data brokers. The subscription costs are high for an individual but exceedingly cheap at volume.
Old data ages out relatively quickly. Much of it persists for a long time, but its value falls off fairly quickly. Simply cutting of further feeding of this collection helps immensely. The payoff isn't immediate, but in a year, or two, or five, or ten, you'll have very little online footprint.
You can actively request exclusion from collections or deletion of stored data. This may not succeed, but you've little to lose by asking.
Using aliases or pseudonyms going forward helps. Keep in mind that there are many and powerful deanonymisation tools, and putting data back together is often very easy. Good "tradecraft" (anti-surveillance practices) is hard, but even a modest effort makes you far less trackable than the typical person.
Not having a strong online presence is itself a strong signal. At least for now, though if perceptions and practices change it may not be. I'm very mixed on the question of whether it's better to go off-grid or to throw out spurious or innocuous noise. A chief argument against "chaffing" (throwing out distracting information) is that it's still pretty easy to detect the signal within the noise.
An incremental approach can be surprisingly effective. Find the largest footprints, go after those, and keep walking down the list. Eventually you'll have little to show for.
Updates & Corrections: Swapped in Helen Nissenbaum for Martha Nussnebaum (my error), added Paul Baran (co-inventor of packet-switched networks and very early digital privacy author), added links for named authors pointing to publication(s) relevent to discussion.
This is great advice, thank you.
I ran scripts over my Facebook to wipe every post and comment I've ever made (I'm still shackled to it because my family refuses to move). I've also done the same with my Reddit account. I'm under no illusions that it's gone but at least it's a little harder to find. I think it all depends on your threat model. If you're just wanting to keep your private life private, I guess not tying things to your real name and liberally using alts is fine. If you're trying to evade a nation state it becomes a lot more complicated.
I don't mean to necropost, but I had this bookmarked because I meant to reply. Nobody seems to have mentioned Michael Bazzell of Intel Techniques yet. He has published tons of online resources, guides and books to assist in stuff like this. He is very much considered an expert in the field of online investigations so he would know where to find stuff, and how to get rid of it.
https://inteltechniques.com/links.html
I’ve never had to do that, but I’ve heard from others that the best way is to create a bunch of content by and/or about yourself to bury the stuff you don’t want found. I don’t know if that fits the bill for what you’re after (making old stuff go away) or not (reducing your online footprint so there’s no info about you out there). If you write a blog about some subject and have lots of articles, for example, that’s more likely to come up first (assuming your content is not terrible). Or make a bunch of pages on public social media for things you’re interested in. Like have a LinkedIn account, Facebook account, Instagram account, Pinterest account, Twitter account, Yelp account, etc. and post stuff to them regularly. (It can all be random stuff like photos of cars, guitars you think look cool, recipes you like, etc. It doesn’t have to be anything personal or revealing.) Also, if you’re worried about your face being on comments on websites, change your avatar on those sites to something benign like a tree or bird or something abstract.
The problem is that I've found screenshots with my name and face on them. And I assume there's a lot more. I always just said "there's no reason why anyone would ever screenshot my stuff" and boy was I wrong.
What is interesting though is that none of my high school social media, which I deleted back in 2017, shows up. Not even a trace. I wonder if it's a time waiting thing.
Gotcha. Yeah, that’s harder. I do think time will help. When I search for myself, I mostly find recent stuff. And I’ve got history with my real name going back 25 years.
Tell that to James Gunn. If a community holds a grudge against you, they will trawl through entire lexicons of past internet posts to find dirt on you.
Fair point. In the same way that your security response varies with your threat model, so too does your reputation response. In my case, I don't think I ever said anything super-offensive, just a few random embarrassing things that make people scratch their head. So for me, it's enough that it's pushed off the first few pages of a Google search. For others, they might need something more potent. There are reputation management companies you can pay to do the work of contacting various sites and encouraging them to take down things. I don't know how well they work, though.
In fairness, Gunn hadn’t actually deleted any of those tweets. If he has deleted those tweets around the time he initially got hired by Marvel in 2012, I don’t think they would have found anything.
I've grown increasingly paranoid about my online presence too, yet I think the only reasons I remain active on sites like Reddit are compulsion & boredom. My approach at the moment is generally to not take part in controversial communities.
Frankly it's a miracle that I haven't pissed off any subreddits enough for them to go out of their way to actively dox me, because I'm not exactly obfuscating my online presence very well. I do the bare minimum, and manage my online persona and real life persona separately. Relatively few people actually know the username I go by online.
You can try to "muddy the waters"...that is, start to post different/fake/gibberish content that makes it more difficult for others to discern who is the "real you". I think someone might have already mentioned about adding more noise than signal. This takes work, but maybe start posting fake photos, and all manner of content all over the popular places to get slurped up by social media and search engine crawlers. For a fake photo, maybe try grabbing some from the following site: https://www.thispersondoesnotexist.com/
Now, this site is supposed to be generated by some sort of AI, so the people portrayed there are artificially created...so who knows...but it can at least give you photos without (hopefully) impacting other real, innocent people. As far as content...maybe there are sites out there that create AI-generated stuff, which you could use similar to the fake photos noted above. Again, none of this removes your footprint...all it does it create a bit more work for you, and hid you a tiny bit more. I myself have not undertaken this approach, so your mileage may vary. But figured it would be what i would do if i was in your position. I hope that helps!
Just randomly discovered this service: https://redact.dev/. Looks like it's free.
How'd you find it?
Was listening to a group of streamers on Twitch talking together and one of them mentioned it and how it was free so I looked it up.
Oh yeah, I’ve used Nuke Reddit before. I also try not to reveal any personal details, I have different accounts for different subreddits that I use, and just try to talk about whatever subreddit I’m using the account for.
Every few months I Nuke the account and start over.
Hey OP, just saw this thread because it got bumped. In case you didn’t wind up finding it, I think this guide should cover exactly what your post was getting at: https://inteltechniques.com/data/workbook.pdf