[00:00] Debbie Reynolds: The personal views expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.
[00:11] Hello, my name is Debbie Reynolds. They call me the Data Diva. This is the Data Diva Talks Privacy podcast where we discuss data privacy issues for the industry leaders around the world with information and businesses.
[00:24] Need to know. Now I have a very special guest on the show,
[00:28] repeat guest. Very few people in the world who can say that.
[00:32] My dear friend Jeff Jockisch, he's a partner at Obscure iq and I tried to give you the nickname Data wizard because I just love the way that you think and love the way that you break down really complex data problems.
[00:48] But you also, you're a data broker expert.
[00:52] Thank God we have you who can explain all these things. And also you do a lot of privacy recovery for VIPs, but you've already been on the show. I would totally love for people to go back to listen to your first episode.
[01:06] This one will be a little bit different. So we're just going to chop it up and find out what, what Jeff is up to, what he's doing. I feel like the people,
[01:17] let's say, I don't know how long ago it's been since we talked on the podcast. Maybe four or five years, something like that. It's been a while,
[01:24] Jeff Jockisch: at least three or four.
[01:26] Debbie Reynolds: But I feel like back then when you were focusing on data broker stuff, there weren't a lot of people talking about it.
[01:35] And now I think especially because people are seeing the impact of the types of harm that people can experience as a result of their data being sold,
[01:48] we're seeing a lot more stuff in the press about it. We're seeing, obviously you've done some really hard hitting work and continue to do so in that area. But just tell me,
[01:59] what are you working on? What are you doing? Yeah.
[02:02] Jeff Jockisch: Well, Debbie, I appreciate the introduction. Thank you.
[02:06] And it's great to be back and talking with you.
[02:10] I think when we originally talked, I was probably focusing a lot on our codex of data brokers and talking about how deeply the data broker ecosystem goes.
[02:21] We do that a lot. But I've sort of turned that into a business now and helping people not necessarily just delete their footprints, but what we do at Obscure IQ now is what we call protective intelligence.
[02:34] And it's essentially, you know, a lot of privacy work is around protecting data.
[02:40] We try to protect the person that the data is about.
[02:43] Someone starts with a name, finds an address and a deed, a school donor list,
[02:48] fitness app, something like that. And they can end up on your doorstep.
[02:51] And that becomes a threat that,
[02:54] you know, is maybe more and more important nowadays, because AI is able to exploit those weaknesses very quickly,
[03:04] either with scams or, you know, in some cases, people are coming after people physically breaking into their houses or kidnapping people or doing anything. There's a financial motivation. If they know you've got money or they know you've said something they don't like,
[03:20] they may be coming for you. It's a very divisive world.
[03:23] And so data privacy becomes more than about just getting less ads. It becomes about, you know, making you harder to find and harder to hurt.
[03:33] Debbie Reynolds: I agree with that. So we're seeing a lot of different things in the news that track back to data brokers, right? And so probably in terms of legislation, the. One of the things that happened over the last few years since we talked was this Daniel's Law thing where this judge,
[03:54] Esther Solis, her son was killed,
[03:58] where there was a disgruntled person who was in our courtroom. They found her address,
[04:04] they went to her house. They wanted to harm her, but her son answered the door and they killed her son. And so I feel like that really raised the profile of data brokers and what data brokers can do.
[04:17] Cause a lot of times, as you say,
[04:19] a lot of times when you hear data broker, a lot of people think, oh, that just means I get more ads on my phone or different things. But really, these people are selling data and with not really caring or thinking about the harm that can happen to an individual.
[04:35] And then another example that came up recently was this lady who went to Rihanna's house and just randomly was shooting at her house.
[04:44] And it's like, how does a normal, regular person know where Rihanna lives?
[04:49] Jeff Jockisch: I know, right? You'd have to wonder. It's not that hard to find most people on the Internet, even people that are famous. And that's a real problem today.
[04:59] I want to sort of say something. You know, there are a lot of data brokers out there. We actually track, like, over 8,000 of them.
[05:05] But the legal definition of data brokers is really murky. And so I don't really want to, like, sort of talk so much about that right now because it's complicated.
[05:14] But there are some data brokers that are better or maybe more useful than others, and some that just really don't care. Right. And they're really just making money on your data and publishing it and making you more at risk.
[05:28] And so I think there's a continuum there.
[05:31] Our friend Heidi Sass says she hates data Brokers,
[05:34] and I have that sentiment, too. But there's also a continuum. There are some data brokers that are much worse than others.
[05:41] And you spoke a little bit about Daniel's Law. There was actually a lot of lawsuits that happened based upon that, primarily from one vector from Atlas Privacy.
[05:51] But I don't know if you realize that some of those lawsuits have actually borne fruit now.
[05:58] In particular,
[05:59] there's a data broker called radaris.
[06:02] And because they essentially sort of, I guess, were losing that suit or lost that suit, the judges essentially turned their domain over to Atlas Privacy. And so if you try to go to Radar.com right now, their whole infrastructure is down.
[06:18] Now, that's not to say that they're not still operating in some sense, but they can't use Radarus.com and a couple of other URLs because they were essentially found in violation of Daniel's Law.
[06:28] Debbie Reynolds: Interesting, interesting.
[06:30] Jeff Jockisch: And there's
[06:30] Debbie Reynolds: a
[06:31] Jeff Jockisch: couple hundred more that have been. Have been sued. I don't know what the status are of those things, but I do know that at least one other data broker sort of essentially disappeared or maybe they've rebranded based upon these lawsuits because they know lose.
[06:45] I. In my opinion. Right.
[06:48] Debbie Reynolds: Yeah, exactly.
[06:50] I want your thoughts about something. You said something on the Internet not long ago that piqued my interest.
[06:57] So I really want to dive down into this.
[07:00] Jeff Jockisch: Sure.
[07:00] Debbie Reynolds: And so you said, we have to stop using binary flags to represent probabilistic judgments, especially about identity. Confidence levels should travel with every binding of identity.
[07:16] What do you think about that?
[07:18] Jeff Jockisch: Yeah. So that's a complicated statement, right?
[07:20] Debbie Reynolds: Yes.
[07:21] Jeff Jockisch: And I said this in a. In essentially a narrative intelligence and cognitive warfare setting. I spoke at the Cognitive Security Conference that was out in Las Vegas, same time as the Black Hat Conference.
[07:35] And the topic that I was talking about was essentially that.
[07:40] That premise and what it really gets at is this is there's a lot of misidentification in the world.
[07:47] And that misidentification causes problems, at least for some portion of the people that are misidentified, sometimes very real harms.
[07:57] But I think that the real issue is that when systems are identifying us. Right. They sometimes get it wrong.
[08:08] And that wrongness just carries straight through. And people downstream of that judgment don't question it. They think, oh, well, the system said that this person is a criminal. I guess I better arrest them.
[08:22] Right. That's what a cop might say. Right. Because they got a flag from an ALPR camera that said, hey, this car was stolen. And so they pull somebody over,
[08:32] but they don't always initially question whether or not the identification was actually true. Right.
[08:38] And so that can mean that you're a completely normal citizen driving your car down the road, you get pulled over by a cop and if the cop isn't doing the due diligence they need on the data.
[08:48] Right. Because sometimes the data comes through without.
[08:51] It might say, hey, it's an 80% chance that Debbie Reynolds stole this car or that this was a match to a plate of a cold stolen car. But that 80% doesn't always come through.
[09:00] Right. It just says, hey,
[09:02] the car is stolen. Right.
[09:04] Or at least that's the interpretation of people that aren't paying attention to all the metadata that travels with such a thing.
[09:12] Make sense?
[09:13] Debbie Reynolds: Totally. Right. So in the past,
[09:16] the way we thought of data or the way we thought of databases is that there were these highly cauldrons of truth where,
[09:25] where this data flowed out and you trusted it. Right. But now you have situations where you have.
[09:32] But let's say a marketing thing, let's say marketing a company selling shoes, let's say is 80% chance that Jeff would like these shoes,
[09:41] no harm. You're right. So that's not going to harm you anyway. But they, they're using some of these same technologies in like these higher risk ways. So it's like as an 80% chance that Jeff stole this car.
[09:54] And it's Right. So it's not about statistics. It is not about percentages. And then I feel like I've heard a couple of data brokers testify in front of certain government bodies and a lot of times, and I have a huge problem with this, they talk about people like statistics,
[10:13] right? So it's like, well,
[10:15] that only happens 10% of the time. It's like, well like so 10 people have to be arrested before you think that it's like a problem. Like I feel like if you're doing something that harms someone's life or liberty, it only takes one situation for it to be a bad situation.
[10:33] And so the example that you gave,
[10:35] and we're seeing this played out a lot in the news where someone's arrested and they say, okay, John stole this car in Texas. And he said, I've never even been to Texas.
[10:45] And they're like, well, we're going to throw you in jail anyway. And it sort it out later. It's like, that's not the way data is supposed to be used.
[10:52] Jeff Jockisch: Yeah, I can give you a real life example of that too. I mean there's plenty of real life examples. I can Give you one that I know. So we have a client that essentially was arrested trying to come back into the country.
[11:04] She went on vacation, came back, and they accused her of a bunch of fraud.
[11:10] And it turned out what actually had happened was there was fraud committed in her name by an impersonator on the other side of the country.
[11:17] And the detective didn't do a whole lot of research and essentially just put out a warrant for the person he thought it was. And when she happened to be coming back in the country, that flag popped up.
[11:26] And so she was arrested for.
[11:28] Overnight,
[11:29] before they figured. Figured things out, they spent time in a holding facility.
[11:34] And that's just like, how does this happen? Right. I mean, she wasn't even involved. Obviously there was some problems with her identity because somebody stole it. Right. But you can't.
[11:44] You shouldn't be arresting people for that. Right.
[11:48] That's where the sort of disconnect comes. Right. There's always this binary decision when it's really much grayer than that.
[11:56] Debbie Reynolds: Yeah, exactly. We saw some of this, like before people went gaga about AI,
[12:02] where people on the no flies list after 9 11, where someone had a similar name. They're like, oh yeah, that's that guy. Let's arrest him. Or he can't fly. It's like, no, I'm not that person.
[12:14] And you're doing a great service. Because it's so difficult, it's almost impossible for an ordinary person to reverse that or get that, get.
[12:23] Inject the right information into a system so it flows through and corrects it. It's almost like. It's almost like the wrong information never dies.
[12:34] Right,
[12:35] Jeff Jockisch: Right. And
[12:35] Debbie Reynolds: you're trying to get rid of something in it. Yeah, exactly.
[12:38] Jeff Jockisch: Well, like let's say you do have like an incorrect hit on your license plate and you get pulled over and arrested. And it's. Your car wasn't stolen, it was a wrong plate match or something like that.
[12:49] Right.
[12:50] But your data is already now at the police station, potentially in legal records and stuff, before they figure out the problem. And how do you correct those other documents that then start flowing to the Internet saying, hey, Debbie was arrested or Debbie stole the car.
[13:04] Right. Even though it was all incorrect.
[13:07] Right.
[13:08] Because the downstream data flows continue to happen too. But I want to point out something else that I think is really crucial.
[13:14] What's really sort of happening here is we're making statements and judgments about people. Right.
[13:21] And then a telephone sort of happens, Right. Where that information gets moved to the next person who maybe understands it a little bit less and Thinks it's a binary decision.
[13:31] Right. And on and on. And I can give you sort of like an example where that kind of stuff is hurting countries militarily. Right? So, like, let's say, you know, somebody looks at a satellite photo and says, hey, there's movement here on the Russian border.
[13:45] Right. It looks like the Russians are moving their troops up, right?
[13:49] Well,
[13:50] they're probably going to give some estimation of how likely that actually is.
[13:55] But by the time that goes through four or five layers of command, it gets up to a general or the president who has to act on that. Right. It may be the Russians are moving troops to the border instead of, hey, we think they might be moving troops to the border.
[14:07] Right. That metadata, that uncertainty gets lost, it gets translated into certainty, becomes a problem.
[14:15] Debbie Reynolds: Wow. I want to talk a little bit about this is something. I did a video about this many years ago, and it seems like it's happening now. And I heard this, and I want your thoughts.
[14:24] I'm sure you're up on all the data wackiness that people are trying to do with data. So I want your thoughts. So I had done a video many years ago about fusion.
[14:35] So fusion meaning company. I say companies in the future will be able to create a situation where they take all these different data points about people and they can connect them together in like, real time or near real time and make judgments or decisions about them.
[14:56] Right. And so we are literally seeing companies try to do this now, especially because of AI. So AI can do things fast, as we know, faster than a human can do.
[15:07] Not always right. A lot of times not right. And then this probabilistic thing becomes a huge problem, because now you're trying to turn things that might be true into something that you're saying is true, and then you're packaging as if it were true, and then you're taking an action on it,
[15:25] which makes it that much harder. But what are your thoughts?
[15:28] Jeff Jockisch: Yeah, I think you're on the button there.
[15:31] There are some tools out that have come out over the past couple of years that sort of gave me a warning that this was happening. There's a tool from a data broker called Forewarn that helps out real estate agents.
[15:42] And it has a really good purpose. Right. The idea is that they want to keep real estate agents safer. So if somebody says, hey, I want to see a house, they can look this person up and say, okay, well, it's safe for me to show this house to them.
[15:53] Because you don't want some violent person showing up in an Empty house with you when you're trying to show it. Right. That could be dangerous.
[16:03] So it has a good reason,
[16:04] but what it actually does is sort of like an instant lookup on your phone number.
[16:08] And so if you type in your phone number into here, it's going to pop up and say, okay, here's Debbie Reynolds profile. It's a snapshot of things that may be aggregations of stuff that don't even include you.
[16:20] Right? And so people could be essentially thought of as a criminal or decided.
[16:27] The system has decided that they're a criminal or a risk. Right? And so now you don't get service, and maybe that service doesn't mean a whole lot. Right? But now people are actually looking that sort of instant profile and making judgments about you.
[16:43] And that could be really concerning because some of those can impact you a lot more than just whether you get to see a house or not. Right?
[16:51] Whether you get a job, whether you get a loan, whether you get an apartment. Right. These systems are becoming more and more automatic,
[16:58] and the automatic part is the problem because it's missing context often.
[17:04] Right. And so, you know, you get denied for access to this apartment.
[17:08] You don't even know why necessarily. You know, we have laws around Fakra, right, that are supposed to say, hey, if something is materially affecting you, the data broker has to disclose that.
[17:19] But most of the data that's getting generated now is exempt or claimed to be exempt from Fakra. So there's no notification. You have no idea what you missed.
[17:31] You have no idea if there's wrong data in your profiles. And I guarantee you there is.
[17:36] Debbie Reynolds: I think that the Fair Credit Reporting act should cover data brokers because they are giving information to entities and they are making.
[17:47] These companies are making decisions about people and they don't know about it. Right? So like you said, like with the house thing or even with a job,
[17:57] it's not like, okay, I applied for this job and then I didn't get it because my credit score is X. That's different than saying nothing,
[18:07] like, you didn't get a call back because they got some information that was wrong and that's it. So this could continually snowball against you without you ever even knowing anything about it?
[18:19] Jeff Jockisch: Yeah,
[18:20] absolutely.
[18:21] We were actually thinking about creating a service, but it's not really in our wheelhouse right now. That would essentially be like a personal data audit of people who are job seekers to find out, like, okay, when a company looks me up, what do they see?
[18:34] Do they see? Is the information that they see correct?
[18:37] Because Maybe it isn't. And there's a lot of job seekers who are having trouble finding jobs and are wondering, like, is it me or is it my profile or is it the companies?
[18:47] What is the problem?
[18:48] And nobody's really looking at that data one. Right.
[18:52] Maybe it's just you got a flag on you for something. Right. Maybe it's a bad credit score, maybe it's something else. And so then you don't get hired or even considered.
[19:01] Debbie Reynolds: The one thing, though,
[19:03] that gives me some hope in a little bit away is that in the past, especially when people are being discriminated against or whatever, they didn't have the data or the information.
[19:14] So even now, they may not be able to get it, but it exists somewhere.
[19:19] So there, if a situation happens where they can obtain it, they figure out where it is, and where they obtain it, it is written right. Somewhere,
[19:29] at least there is a record of it someplace,
[19:33] you know. So the idea is like, how do we get it to the people who need it, and how do we get those changes made, if possible? Yeah,
[19:41] Jeff Jockisch: yeah, absolutely.
[19:43] Debbie Reynolds: I want your thoughts about data breach. So you tell me about this project you're working on,
[19:49] about the data,
[19:50] the data breaches that you're tracking.
[19:53] It's a really interesting project because I don't think anybody's doing. I don't know anyone who's doing what you're doing right now on this.
[19:59] Jeff Jockisch: Yeah. So we're getting ready to release a bunch of information on data breaches that there's services that sort of track data breaches. There's actually a lot of them. But collecting the information and getting it all right,
[20:13] and then actually making something out of that information is sort of hard.
[20:17] And I don't think anybody's really doing that as well as they might. And so we're trying to do that. Part of that is creating what we call a breach risk index so that we can essentially tell somebody who's been involved in a breach,
[20:30] whether that's a client or just the general public,
[20:32] that, hey,
[20:34] the information that was leaked in this particular breach is not all that important. You don't really have to worry about this one. But this one over here, hey, you really need to worry about this one because it's got your home address and your Social Security number in it.
[20:46] Right. And those two pieces of information,
[20:49] the value of them, don't degrade over time. Even if the breach happened four years ago and it now just becomes circulating on the dark web,
[20:57] chances are that's still your address and it's still your Social Security number. There's no degradation in the value of certain pieces of data over time.
[21:05] Now, some do decline, right? Like your email address might get changed more often, your phone number might get changed more often. Different things like that. But it depends upon the data element, how valuable it is and how little it degrades over time.
[21:18] If you step back a little bit, right? We get notified by data breaches, like every day, multiple times.
[21:24] Sometimes you just hear about it in the news, sometimes you get an email because you were actually involved in the. The company's admitting something happened.
[21:30] But by our estimation, there's something like 70,000 of those things have happened over the past few years.
[21:38] But only about a thousand of them are known to be circulating. Data sets, maybe 1500 on the Internet in the dark Web, primarily, where you can go up and buy this data breach data set.
[21:49] When those things happen, right? The risk is no longer a phantom potential risk. It's real.
[21:56] The data is out there. It's being actively used by bad people.
[22:00] And that's when you really have to worry about it. It's not to say that if a breach happens and it's not circulating yet, that there's no risk,
[22:08] right? Because maybe the data is out there, they just haven't released it yet, or maybe they're using it very quietly internally,
[22:14] some operation.
[22:16] But when it's actually posted on the dark Web, you've got a problem, right? And unfortunately, all of us have data about us posted on the dark Web.
[22:24] Debbie Reynolds: What types of things do people do that they don't realize that creates more risk for them?
[22:32] I'll give you an example. It gives me, Ajita, just to think about some of the things that people do. Like, I saw this photo where this lady, she. I guess it was like her kid's first grade picture or something.
[22:46] And so behind her is a board, and it has the school name, her name, her birthday, literally, I'm sure they had the location in the photo. And I was like, I could have fainted.
[22:57] You know, I'm not a parent, but I'm like, why would you put this on the Internet? It's like,
[23:03] this is enough information for a crazy stalker person.
[23:07] And that's literally what it is, a social engineering. But you're enabling it by giving people this other information that you didn't necessarily need to give them. But what do you think?
[23:18] Jeff Jockisch: Yeah, I think you're on target there.
[23:20] More and more information gets collected on us. And because there's so many companies collecting that data, it's very likely one or more or Many of them are going to get breached.
[23:30] And that data then ends up in the hands of criminals and criminals or advertisers sometimes there's not a whole lot of difference between the two. But I don't really go after advertisers per se.
[23:41] Right, but the.
[23:43] But the data points that are available allow people to infer a lot of things about you.
[23:50] Sometimes they just tell them outright where you live or what you like or what you do or who you are. Sometimes they can make inferences. But you know, one little piece of information might be valuable enough to social engineer you.
[24:01] And there's a lot of people that think that they, oh, I'm smarter, I'm not going to ever get social engineered.
[24:07] They're wrong. It's not about intelligence. It's not even about keeping your guard up. Because the right call or the right pitch at the right time will get by those defenses.
[24:16] Because you have to trust in order to work through this world. Right. You have to trust that I'm talking to you and not a fake Debbie Reynolds. Right. I have to trust when I log in that I'm actually going to the right website.
[24:28] I have to make all these different trust decisions,
[24:31] but the attacker is going to take advantage of that.
[24:35] Let me give you an example of a really simple one. Like let's say somebody was to breach your dry cleaning company.
[24:42] Well, probably not a whole lot of bad data there that's going to hurt you, right?
[24:46] But how about this happens, you don't know about it because maybe they don't even know about it. And you get a call that says, hey Debbie, you know, you paid for your dry cleaning, you know, a couple days ago, that $71 charge, it didn't go through.
[24:58] Can you give me your credit card number in.
[25:01] Well, they know who you are, they know what you did, they know how much you paid, right. Are you not going to give them your credit card over the phone again?
[25:09] You probably are, right?
[25:11] Probably not thinking that this is a scam to get your credit card, but it might be because you don't know for sure that that's actually the dry cleaner calling you.
[25:20] Right. You know, that could be spoofed pretty easily.
[25:23] Debbie Reynolds: Yeah, totally. I personally think that some companies,
[25:27] maybe the company is not sanctioning this, but somehow some companies customer lists are ending up in the hands of bad actors who are using that to turn it around. Just like you say to say, hey, we know you have account 0067 your thing and go through, give us your credit card.
[25:48] I mean, and I feel like, some people may think this is what harm could happen if I just gave someone my customer list. It's like, that's the type of harm that you need to really think about.
[25:58] Jeff Jockisch: Yep. Yeah.
[25:59] Debbie Reynolds: Yeah.
[26:00] Jeff Jockisch: It's a scary world out there because you have to trust, but it's hard to trust.
[26:05] And people just don't realize how vulnerable they are. I almost fell for one of these scams a few years back. The guy called at the right time. I was expecting a call from an Internet service provider to fix an issue,
[26:15] and he was talking that same language. I thought that's who it was,
[26:20] and it wasn't.
[26:21] And I almost let them into my system.
[26:23] Debbie Reynolds: Yeah. I think it is naive for anyone to think that they're too smart to fall for one of these things because the sophistication is just off the charts now. I used to get upset when people used to say, oh, you could tell email's fake because they have misspellings in it.
[26:45] It's like, that hasn't happened for years.
[26:48] Like, you act like people can't get Grammarly or spell check or whatever. It's like, are you serious right now? It's like the threats are becoming more sophisticated, and we need to educate people about that sophistication.
[27:01] Jeff Jockisch: They are getting very much more sophisticated. But I want to say one thing, right? Sometimes those threats come in and they throw in that kind of problem,
[27:11] right? So, like, if you're looking really closely, you're going to see, hey, this is obviously not the same company.
[27:16] Sometimes they don't care about that. Right? And the reason they don't is because they know the people who are very skeptical are gonna see that and never call. Right. They don't get into the queue.
[27:25] But the people that aren't paying attention to that. Right. Are much more likely to be victims.
[27:29] And so if you're falling for this scam that has an obvious flaw, you're probably more likely to. Actually,
[27:37] they're more likely to be able to follow completely through with it and get your money or your data or whatever it is they're trying to accomplish.
[27:44] So sometimes those imperfections are left there intentionally.
[27:49] Debbie Reynolds: Interesting.
[27:50] I had someone call me.
[27:52] They were like. They said they wanted to verify who I was. I was like,
[27:56] no, I need to verify who you are. I'm not giving you this information.
[28:00] And so they were asking questions, so I'm not going to ask for that or whatever.
[28:04] And so I was like, this call is over.
[28:07] This is the end. Okay. It's like, if you're real, write me a letter and then I'll talk to you or whatever.
[28:14] Jeff Jockisch: Let me tell you something. So there's different ways these companies get your data and different ways they come after you. I get a lot of political spam right now. Probably everybody is, you know, I generally don't respond stop to any of it because I don't know which ones are legitimate or which ones are just a scammer trying to figure out if I'm going to respond.
[28:32] Right. And if this number is still active. But there's a lot of problems out there.
[28:38] And so one of the reasons that I have some spam on me that it's hard to get rid of is because I bought domains in the past, right. And in the past I didn't use enough domain privacy.
[28:50] And there are also lots of holes in how that can work. And so some of my information has essentially been published out there based upon this domain privacy lack thereof or stupidity on my part in the past.
[29:02] Right.
[29:03] And so people see, hey,
[29:06] somebody just registered for a domain domain and here's their information because they didn't turn the privacy on. And then you're going to immediately start getting spam.
[29:14] So if you're buying domains you have to be really careful.
[29:17] Debbie Reynolds: And they've changed it a lot over the years too, so they have more base protection than they used to have. But then a lot of times they're selling as a another feature that you buy kind of this extra thing.
[29:31] So.
[29:31] Jeff Jockisch: Well, right. It should come by default and some registrars do that, but other larger ones don't.
[29:37] There's also a problem sometimes too,
[29:39] like okay, let's say you get this domain but you're not actually using it, maybe you're not paying attention, maybe you bought it from a registrar that you don't normally use and it had protection but then it goes dormant because you forgot to pay the bill right now.
[29:54] Right.
[29:55] Even if you eventually realize this and get the domain back, your information has probably become non private at that point. Right. So now they know that you own this. Right.
[30:04] And the ownership of the domain is not necessarily a problem. Right. Maybe it's just a innocuous domain, but the fact that you're contact information is connected to it's a problem.
[30:14] Debbie Reynolds: Exactly. I highly recommend if people, you know, buy out a mailbox or something that's not even related to you that you can use for stuff like that and then it's like, ah, I got you, you think you're smart, but I out foxed you.
[30:29] What's your thoughts on something?
[30:31] Maybe this is controversial. Maybe not, but this is about age verification on the Internet and these age verification laws.
[30:40] I,
[30:41] as a result, a lot of these age verification laws,
[30:44] a lot more children will have to give more information about them put in digital systems than ever was before.
[30:54] And so my concern is that I prefer not to put,
[31:02] I think if I have to choose, the way to protect people is to put less of their stuff in digital systems. So the fact that these laws are going about and then different companies, they have different ways that they want you to do this verification, especially around children.
[31:18] I am concerned that more kids who never had their stuff in digital systems,
[31:25] it will create more risk for them down the line. Especially like I feel like, and I've seen this happen to people like identity theft of children is off the charts because
[31:37] Jeff Jockisch: it's off the
[31:37] Debbie Reynolds: church. You don't have a kid who's born. They get a Social Security number when they're born. But someone could take that and make, by the time they're 18, they probably had houses and cars and everything else they didn't even know anything about.
[31:50] And so that, that is what concerns me about these laws is that we're giving even more information,
[31:58] especially around children who can't really protect themselves. But what are your opinions?
[32:03] Jeff Jockisch: Yeah, I think it's a bad situation.
[32:06] We need to protect children. Right. And there's lots of different threats out there against them,
[32:11] whether that's sextortion or just data brokers taking their information or whether it's something worse like csam. Right. And we need to be cognizant of that.
[32:23] But I think that generally these age verification services aren't going to be successful and are probably going to have more downstream harms than good,
[32:32] in part because they not only make children register, but essentially everybody has to register so that you know who's the children and who's not. So it means all of us have less privacy.
[32:41] Right. Including the children, as you point out, where they may not have even had to have a profile before. Now they're giving away identity documents.
[32:49] That's not good because these companies don't have a good track record of keeping that information safe.
[32:54] But there's also the question of are the rules even going to be all that valuable? Right. So, okay, you put the identity info rules in to keep the kids out.
[33:03] Does it actually keep them out? And most studies either haven't looked at it or say the opposite. Right. That they find ways around it pretty easily.
[33:12] And so what it really is, in my opinion is a data grab by big tech,
[33:19] mostly the social Media companies.
[33:21] And you'll notice that the Facebook settlement that happened with the multi state deal, not the more recent one that just happened a couple days ago, but the one that happened with like 30 plus states.
[33:33] Part of that settlement essentially said that Facebook had to put in age verification stuff.
[33:41] What's interesting about this, right, is we think that Facebook actually wanted this, right? It sounds sort of counterintuitive that they would want to be regulated, but they would rather have that regulation and be able to collect the data.
[33:53] So that essentially the onus of letting a kid into the system is now beyond them, right? They can essentially wash their hands of it,
[34:01] right?
[34:02] We know that that's not true because the kids are still going to get in, right? But they can essentially say, hey, we put up this gate and the gate's supposed to work and you know, blah, blah, blah, right?
[34:11] In the meantime, they're just collecting massive amounts of more data about us that they can use however they want and potentially lose.
[34:19] Debbie Reynolds: I agree with that because it's like, okay,
[34:22] Johnny is three now, but they're keeping track. Like when is he six, when is he 12?
[34:29] What can we sell his parents? What can we push his parents based on his age? You know, I always thought just in general the best way to protect data is to keep it out of digital systems.
[34:41] And actually now with your thoughts here, this has been my experience, especially with like high network individuals.
[34:48] They do a lot to keep themselves out of digital systems in ways that maybe you and I or just ordinary people can't do.
[34:58] Jeff Jockisch: I mean,
[34:59] I think it's very true. And not every high net worth person or rich person or even vulnerable person is cleaning up all their data, but more and more of them are and they're finding ways to do it.
[35:15] You know, you can do a little bit of that with services like Optory, incogni, deleteme, we like Optory.
[35:22] But these consumer level services really don't go far enough if you're at physical risk. Right? Because chances are there's still information out there about you, whether it's in the data broker ecosystem or outside of that, on the dark web or in public records or in social media or wherever else it might get posted.
[35:40] And so those services don't generally go far enough.
[35:45] They don't look into all the data ecosystems first of all,
[35:48] just because that's a limitation.
[35:51] But even then they don't always get every single bit of information and it's hard.
[35:58] I'm not trying to knock them because I think what they do is very valuable. It can get rid of a lot of Google results that are popping up that make you easy to find,
[36:07] but it doesn't necessarily get rid of all the threat from somebody who's sophisticated or even partially sophisticated, or nowadays just has access to an AI that's sophisticated and can go find the data.
[36:18] Right. And that's where it becomes scary.
[36:21] Debbie Reynolds: Wow, this is so eye opening. What do you think? What should we be doing in general? Whether it be people as a profession,
[36:30] individuals, what should we be doing now or thinking now that's probably not on people's radar or things that maybe they need to consider about either protecting themselves or the way that they work or protect data.
[36:43] Yeah.
[36:44] Jeff Jockisch: So when you walk around the Internet in the digital world, you're creating data no matter really what you do. If you buy something with a credit card, if you go to a pharmacy, all that information gets tracked.
[36:56] And so even if you're deleting your digital footprint, it's constantly building back up. Right. Because there are some vendors that will collect that information and it'll eventually turn into a profile and pop back up.
[37:07] I guess the things that you can really do to,
[37:10] to have less of a footprint other than trying to do a reduction in that with a service like one of the consumer services or a service like ours, we do it on a deeper level is do things like what you're talking about, right?
[37:23] Which is change your email address.
[37:26] Because your phone number and your email address and to a lesser extent your physical address are the points where data aggregates about you.
[37:36] So a data broker profile is going to be keyed on a hashed email, for instance, right. Or a phone number. And so if you change your email,
[37:43] you change your phone number, you change your physical address, you're much harder to track by the data brokers, right. And then there's less information out there about you.
[37:52] That's really one of the core mechanics, right. You can't go sign up as Debbie Reynolds@debbireynolds.com for 15 services on the web and expect that information to stay with those companies.
[38:05] Right. They end up selling it or losing it. Right. And it becomes a profile. It attaches to your profile that sometimes it's not those companies fault directly.
[38:15] Sometimes it is, right. But there are ways for other companies to be able to get at that data and turn it into a profile.
[38:22] So I mean, if I was probably take your email address and pop it in, I could probably,
[38:27] I could run it against 500 or a thousand different SaaS, services,
[38:31] services that you might have signed up using Your phone number, email address, and you would pop up in a bunch of those.
[38:36] And even just the validation that you have in account there can sometimes help us build a profile on you. Right? But often those services actually give you information back.
[38:47] So if we, like, try to find out if you've got a Facebook account, right, and it says you do,
[38:52] Facebook's going to actually tell me something about your phone number. Probably not the whole phone number, but it'll give me a couple digits. But this other company over here will give me a couple digits that maybe are in the prefix.
[39:02] Right? And I can essentially add more and more data points together and figure out, oh, look, that that's her phone number. That's her primary phone number now,
[39:10] Right. Even though only a little bit's being given out by each company.
[39:14] Debbie Reynolds: That's true. It's a lot of things. And then also, this is one thing about people.
[39:20] Let's say, for instance, you said somewhere online that you like peanut butter and jelly sandwiches, right? Let's say that's like the only thing they really know about you. And so they can make it seem like, oh, Jeff only eats peanut butter and jelly sandwich.
[39:34] That's the only thing he knows, or only thing that he likes, or whatever. So a lot of this data can be misconstrued very easily, especially because of some of those gaps, because they are making additional.
[39:46] They're stretching it, right? They're making more inferences, they're trying to make more valuable.
[39:50] They're trying to say, even these people search things. They try to, like, give you little hints like, look, this thing, we're gonna hide it, but if you pay us money, we'll show you this thing that this person did and may not really,
[40:01] really even be true.
[40:03] Jeff Jockisch: Right? Well, they'll make inferences, right? If you post about food, they'll probably tag you as a foodie. Right?
[40:09] I've done that before, but I'm definitely not a foodie. Right? I mean,
[40:13] so the advertisements that get then targeted at that are going to be invalid, right? They're just wasting money on that. And there's a lot of tags in a lot of systems that are incorrect.
[40:22] That's not to say they all are. They're probably right most of the time,
[40:26] but most of the time doesn't always cut it, especially when that data starts to get personal and dangerous.
[40:32] Debbie Reynolds: It's so true. Thank you so much. It's so much fun to talk with you and I'm so proud of the work that you've been doing. I mean, you're doing Such a great service just to the world.
[40:43] And so I just really admire all the work that you do and your big brain that you are really focused on these hard problems.
[40:53] Jeff Jockisch: Well, I appreciate that, Debbie.
[40:55] I think, you know, you shine a light on so many different privacy problems and we are very glad to have you. You, me, speaking on behalf of the world.
[41:06] Debbie Reynolds: Well,
[41:06] Jeff Jockisch: because there's not enough people that are calling it out, at least in a general way. Some people, you know, you'll get a report that says, hey, data broker, car manufacturers are selling your data.
[41:14] Okay, well, that's great.
[41:16] All this stuff are data points that have to be understood and translated for people. What does that actually mean?
[41:22] And that's something I try to do and that's something you do really well.
[41:26] Debbie Reynolds: Oh, thank you. Oh, my gosh, that's so nice. That's so nice. Jeff, how do people get in touch with you to work with you on obscure IQ?
[41:39] Jeff Jockisch: So, yeah, you can just come to obscureiq.com or you can look us up on LinkedIn or you can search for my name on the Internet and all those things will lead to us.
[41:50] Debbie Reynolds: Yeah, that's tremendous. And I highly recommend people follow. Jeff,
[41:55] on LinkedIn, you always pose these really fascinating questions, very provocative and so I'm sad that I don't get a chance to always engage. So sometimes I quickly reading and I give you a thumbs up.
[42:07] Oh, I try to come back to it,
[42:09] but. But you, you always ask interesting questions that are very thought provoking and people do need to really think through this. So this is a really hard problem and you know, really just so many,
[42:21] so much of your data is out there and being able to understand how that impacts you is very important.
[42:27] Jeff Jockisch: Yeah, I appreciate that.
[42:28] We haven't been posting as much on LinkedIn. We actually have a new substack, but that's going to actually feed into LinkedIn. So there'll be more LinkedIn stuff coming.
[42:37] Debbie Reynolds: Cool. Oh, I can't wait to see that. Well, thank you so much. Well, we'll talk soon.
[42:42] Jeff Jockisch: All right, you take care. That's great.
[42:44] Debbie Reynolds: All right,
[42:44] Jeff Jockisch: thanks,
[42:45] Debbie Reynolds: you too.
[42:46] Jeff Jockisch: Bye.
