RFI: Removal of online footprint services.

[Jason M]

Howdy all. I am considering buying one of the commercially available online presence removal services. A coworker has placed himself on the radar of the "auditors" who baid PD into doing youtube worthy things. There is concern about being doxxed. There are a number of services offering removal of online presence for +/- $200 a year. I am considering https://privacybee.com/

Does anyone have any experience with this or other services?

I plan on signing up for a service today.

[Chance]

There's a myriad of pros and cons, but at the end of the day, I think they're a wise option for most people. I started using DeleteMe years ago when Bazzell recommended it, although I wouldn't necessarily recommend them myself (and Bazzell also stopped recommending them at some point).

Bazzell makes his guide book for removing online info about yourself available for free. Just be aware that it's *a lot* of work doing it yourself.

[Jason M]

Thanks Chance!

[Flamingo]

I don't have anything to add other that I am interested in this as well.

[Default.mp3]

Depends on how much hassle you're willing to go through, and how much you trust the data brokers to actually remove your information. Note that the people search sites you can pay to use casually are merely a small subset of data brokers overall.

What I am writing next is based purely on some casual research and not a true deep dive, so it may very well be incorrect.

Part of the issue is that it appears that many of the deletion services send your PII to the very data brokers you're trying to get to delete your information. For example, it is my understanding that the deletion service will send an email to a data broker with all your PII, and tell them that they are to remove you from their database. So, if the data broker previously didn't have your PII, now they do, and because the request is generally a legally binding one, that request is then archived, with all your PII, just now in a different database that is not suppose to have that data sold. In theory, while you've made it more difficult to access your PII, you've also greatly increased the attack surface in which your PII is vulnerable. Now, the PII is needed in order to make the request legally compelling (so that if the request is ignored, the deletion service company can then sue the data broker), so it is in some ways necessary, but because of the automated nature of the requests, the deletion service company is simply sending these requests to all the data brokers on their list, rather than individually querying each data broker to see if they have any information on you before they send out a deletion request.

[Jason M]

Depends on how much hassle you're willing to go through, and how much you trust the data brokers to actually remove your information. Note that the people search sites you can pay to use casually are merely a small subset of data brokers overall.

What I am writing next is based purely on some casual research and not a true deep dive, so it may very well be incorrect.

Part of the issue is that it appears that many of the deletion services send your PII to the very data brokers you're trying to get to delete your information. For example, it is my understanding that the deletion service will send an email to a data broker with all your PII, and tell them that they are to remove you from their database. So, if the data broker previously didn't have your PII, now they do, and because the request is generally a legally binding one, that request is then archived, with all your PII, just now in a different database that is not suppose to have that data sold. In theory, while you've made it more difficult to access your PII, you've also greatly increased the attack surface in which your PII is vulnerable. Now, the PII is needed in order to make the request legally compelling (so that if the request is ignored, the deletion service company can then sue the data broker), so it is in some ways necessary, but because of the automated nature of the requests, the deletion service company is simply sending these requests to all the data brokers on their list, rather than individually querying each data broker to see if they have any information on you before they send out a deletion request.

That was my impression of the process as well.

[Chance]

Part of the issue is that it appears that many of the deletion services send your PII to the very data brokers you're trying to get to delete your information. For example, it is my understanding that the deletion service will send an email to a data broker with all your PII, and tell them that they are to remove you from their database.

That you have to send PII to have PII removed is sort of necessarily the case. Some services will send a blanket "remove me" request via e-mail and others will actually use the data broker's system to submit that request.

So, if the data broker previously didn't have your PII, now they do, and because the request is generally a legally binding one, that request is then archived, with all your PII, just now in a different database that is not suppose to have that data sold.

That may be true, but the goal of this exercise is to remove yourself from the low-hanging fruit of people search websites where anyone can casually find it.

In theory, while you've made it more difficult to access your PII, you've also greatly increased the attack surface in which your PII is vulnerable.

I don't agree. Having your data on a people search website that can be scraped by anyone means that your data is going to end up pretty much everywhere anyways.

Now, the PII is needed in order to make the request legally compelling (so that if the request is ignored, the deletion service company can then sue the data broker), so it is in some ways necessary, but because of the automated nature of the requests, the deletion service company is simply sending these requests to all the data brokers on their list, rather than individually querying each data broker to see if they have any information on you before they send out a deletion request.

That depends on the service. Some send blanket e-mails, some explicitly verify you're present in the system before doing anything. And realistically, the odds of any of these services suing someone on your behalf is slim to nil.

[4RNR]

What does this actually remove you from?

[Default.mp3]

That may be true, but the goal of this exercise is to remove yourself from the low-hanging fruit of people search websites where anyone can casually find it.

Sure, that's why I stipulated it was only part of the issue. I'm not saying that using deletion services is a bad idea, just that it does open yourself up to other vulnerabilities that many may not have thought about, that could be avoided if you instead did it manually by yourself, especially if you're primarily only worried about public people search sites, rather than all data brokers, since that's a much smaller subset of data brokers in general.

Plus, if you're the conspiratorial kind, it also rules out possibly falling victim to the deletion service selling your data back to the data brokers to keep you hooked on their deletion services.

I don't agree. Having your data on a people search website that can be scraped by anyone means that your data is going to end up pretty much everywhere anyways.

Eh, I dunno, I've definitely found vastly differing results between the different big people searchers when searching myself, so I don't know how much cross referencing they do between their different sources, though I'll also admit that this was using the free searches and not the paid ones. But I will also weasel out of this by saying that I did stipulate "in theory", LOL.

That depends on the service. Some send blanket e-mails, some explicitly verify you're present in the system before doing anything. And realistically, the odds of any of these services suing someone on your behalf is slim to nil.

Sure, I can believe that some services don't utilize just a mass emailing system, but the real problem is, how can you tell which service does which? They typically seem rather type lipped on their actual method of operations for the most part, and when I looked into this a few months ago, there wasn't any kind of list or other resource that gave that kind of information out. If you are aware of such a resource, I would love to see it.

[Cory]

Doxxing is... shitty. I was doxxed late last year. Heres how it went for me:

An event that upset others occurred. I was never charged with a crime, or broke a law. Others posted my name/address/ images of home and family publicly with false story about the events. They outright lied about what occurred prior to, during, and after the event with a slant that made them a victim, and myself a villan.They insinuated I had video of the event and was not providing it. Not true. The social media post included a non-specific call to action against me. It was shared a few hundred times and across a ton of local facebook groups. I painstakingly made all my stuff private, which is difficult. Remember your property appraiser will have your information if you are a home owner. Police reports may include your phone number. Court documents.

Myself, wife, father all received harassing/vague threat messages on social media. Dad closed his FB business page as a result. His google page got negative reviews. Someone drove passed Dad's house and yelling insults. I walked my entire family through FB privacy settings to hide all past posts/future posts/ etc. Pictures from family members pages were posted and shared.

Time went on, local media was involved and I got a lawyer because of the media. Things are calm at the moment, but it was not nice. I had threats about my 7 year old, and had to warn his school not to release him to others. Serious stress. I lost 9lbs in about 2 weeks.

I looked into anti-doxx protection. The problem is that it is... general. You live somewhere, you have a phone, etc. Anyone can bump into you in public, anyone can learn your name, anyone can work to figure out where you live. The anti-doxx seems to prevent vague "data breach" type information from being out there. I don't think any of them would be able to actually remove all of your information.

Even with little info, a call to action can be made. And a FOI request WILL find you. Police reports, property appraisers, court docs... all sorts of stuff is able to be found. You just can't remove it all.

It's my opinion that having a strong positive reputation, built by actually doing the right thing, is the best protection. That coupled with real world networking with other upstanding folks can be a huge benefit. The biggest benefit probably. Beyond that add in normal "hard target" measures like home cameras, being armed, and generally both appearing and training to be capable at violence.

I had recently left my agency, but that didn't seem clear to those doxxing me. So I didn't have some of the resources at hand you do. The "awe" of being LE still played in some with comments online. I think it also prevented some folks from attempting to follow through on some of their bullshit threats. They know what going after the po-lice means.