Privacy and social media investigation: how I tracked down an entire family from one tweet

Last Saturday I presented to students taking part in the brilliant Young Journalist Academy.

The topic was “New Media” (not my title) and the primary aim was to get them up and running with their own blog and learn to publish online.

However, I also knew it would be the perfect opportunity to gauge just how aware a group of bright, 16 and 17-year-olds were on the issues of web privacy and of just how easy it is to track down information about people online.

The case study I included shocked them, especially when it came to Facebook privacy.

I won’t be publishing it online in order to protect the identity of the individuals involved. However, I have been asked to explain the process I went through to obtain the information that I did. This is the purpose of this post.

It frightens me how simple it was to get all that I did.

Step 1
I chose a few keywords “gunfire, shot, attack, missile” and ran them through Twitter search. Most of what I get back is utter rubbish. However, a few genuine tweets shine out. One in particular is particularly interesting: it references the first name of a person and says they were coming under attack. It also uses some army jargon that seems genuine.

Step 2
I check the Twitter profile of the tweet. It provides me with what looked like the real name of the person tweeting, a profile picture, the town they live in and a profile description which connects them to the US military.

Step 3
I use Google to search for their full name and the town in which they live. This brings up two results on White Pages. One of these is associated with a person who had the same first name as the person mentioned in the original tweet. It looks like I may now have their home address and phone number (I haven’t called to check though).

Step 4
I use Google again to search for the full name of the person mentioned in the tweet and find a Linkedin profile that matches the name and location. It also provides a military job title that makes perfect sense in the context of the tweet.

Step 5
I conduct a number of Google searches that include the name of the person mentioned in the tweet, their location and their job title in an attempt to find out more information about where they might be.

This is not so easy, but thanks to a local military historian and an interview with someone else on a military history website I can make a very good guess at the regiment they serve in and where they are currently stationed. I imagine if I hadn’t come to this topic cold, I could find more ways to search or, indeed, could make a few useful phonecalls at this point…

Step 6
Google again. This time I search for both the name of the person in the tweet and the name of the tweeter. This brings up a profile on the website of a small business.

The “About Us” section has an entry about the tweeter. They are a member of staff. There is a profile picture (the same one used on Twitter), job title and some friendly information about them confirming: that they are married to the person mentioned in the tweet, how long they have been married, the names of their children, their email address and the organisations that they volunteer with in their spare time.

Step 7
I Google (again) the name of an organisation I now know the group the couple volunteer for. It has a public Facebook page. One scan for the tweeter’s first name on that page uncovers comments left by a Facebook profile that the couple share.

Step 8
Clicking onto the couple’s Facebook profile reveals that they must have Facebook’s recommended privacy settings. This means that all their past profile pictures are publicly visible. So, I now have a lovely family photo to go with the names of the couple and their children.

Step 9
The couple have also been fantastically diligent with linking up with family members on Facebook. This means I now also get to see a list of profiles for the extended family. I learn the maiden name of the wife. It also turns out her mother has no privacy settings on her profile at all – her wall and all her photos are available to browse.

However, I don’t browse them.

I’ve gone from one tweet to knowing an entire family’s names, location, address, contact details, what they look like, how they are connected to the military and, potentially, where a part of the US army is coming under fire.

I stop there because I am already completely freaked out by just how far I’ve already got from a few Google searches.

It’s easy to say it’s incumbent on the individual to protect their own privacy, but it’s hard to see how we can always stop this type of jigsaw identification of people online. Sometimes people are mentioned online without them even knowing. Certainly having stricter default Facebook privacy settings would help, but it’s not the only answer.

The PCC has started to issue guidelines to journalists about how they use information from social media profiles in their stories and anything obtained online is still subject to the “public interest” test. However, the “reasonable expectation of privacy” guidance doesn’t feel that well tested yet – especially when you can easily build up a picture of someone from fragments from numerous public websites. I’d be interested to get some more information about the law in this area.

Even if it had, I am sure there are those who would still be interested in using this type of technique for their own purposes and would not feel bound by any ethical code…

Facebook foraging – leave my friends out of it

My Facebook privacy settings

Being online most of my waking hours, I often think of the identity trail I’m leaving around the web and the issues that has in terms of my privacy.

However, I’ve seldom stopped to think how my activities may affect the privacy of my nearest and dearest.

Tonight, as we in the newsroom sought to follow up on reports that named two girls who have been murdered in Ladywood, it was the latter that struck home.

One of the girls had kept her pictures and her profile public to the West Midlands network. Her sister had been more careful, but there was enough there (her profile pic) to identify her in her sibling’s pics. Family and friends were also listed publicly as “friends” in both profiles.

Continue reading

The price of going public

A few months ago I shot a video on a borrowed N95 mobile outlining the reasons why I thought newspaper journalists were going to have to be more public and transparent on the web.

Media was becoming increasingly personality driven as users decide which sources to trust and which to reject, I argued. People want to know who is behind the news and what they stand for.

It was the first time I had put myself “out there” and, I have to admit, it wasn’t altogether a comfortable experience. I had always said I was happy being a newspaper journalist because it gave me the luxury of standing behind the photographer’s camera. Not anymore.

But, by becoming more visible, I met a wealth of interesting individuals on platforms such as Seesmic and Bambuser who have talked, debated and helped me learn so much more about what the web can offer. Going public didn’t seem so scary after all.

So when my editor Marc Reeves asked if he could put me forward as a potential panellist for The Big Debate I agreed. Three months ago I wouldn’t have dared but, I reasoned, how much worse could it be than doing a Seesmic post?!

Of course, it was far more nerve-wracking, but I was very glad to be given the opportunity to do it. There were a number of firsts and innovations that took place at The Big Debate that I am very proud of and will post about later.

But it also demonstrated the flipside of going public.

Someone who either watched the debate at the ICC or online decided that they did not like me. Not just that they didn’t like my arguments on the future of regional newspapers, but that they didn’t like me. So much so that they intimated in a comment on my blog that I must have done something rather unsavoury to get myself on the panel. The full comment, which was originally on my ‘about’ page, and the responses to it have been put into a seperate post.

That was pretty upsetting. The odd thing was that, when I read the first line, I was glad to see someone had been critical of what I said. I can learn from criticism.

But, when I realised it was turning into a personal attack, it became something altogether different. It felt threatening and misogynistic. After all, how many men have been accused of sleeping their way onto a panel? It was also a rather unhappy thing to learn that the IP address was local.

Now I know enough about flamers to have expected this to happen at some point. The web allows people to hide behind relative anonymity and, as a recent debate on women and the Internet suggests, it could have been far nastier. But it still knocked me a bit and led me to wonder: how many regional newspaper journalists are prepared for dealing with such comments online?

There are two issues at stake here:

1. The emotional response:

I can easily imagine journalists who are not used to online debate feeling very threatened. How would you prepare someone to deal with this and put it into context? It would be a great shame and loss if such a comment made them withdraw from online conversations altogether.

As an aside, I wonder if the current reluctance shown by some journalists to engage with readers online is, in part, a response to some of the comments that can be found in the old-style, poorly moderated, regional newspaper Internet forums where flamers are rife.

2. The public response.

How easy is it for someone who has been attacked to hit back in a similar way? Very: an individual that is hurt, angry and feels unfairly targeted is going to want to bite back with an equally nasty comment. I’ve seen it happen time and time again on blogs.

But, by hitting back, the conversation is only dragged further down into the depths of ignorance, anger and spite – hardly the qualities that are desirable in a journalist. Whilst it might be a perfectly understandable response to a nasty comment, I’m not sure it would be seen as acceptable.

As commenting is such an easy thing to do and can be done in seconds – without prior moderation by news editors or subs – it would seem necessary to develop some sort of strategy or format for journalists to use in dealing with personal comments.

I stress that there is also need for journalists to be able to distinguish between attacks on their points of view and attacks on their person. We must be able to accept strong, vociferous criticism of our ideas and show that we are capable of responding reasonably and intelligently. I think it’s easy for people to mix the two up.

All of the concerns above suggest to me that, as regional newspaper organisations push their journalists into a more public online arena, a little bit of guidance and support is needed to help them deal with the negative side of transparency.

One thing that has emerged from this is that I am lucky to be part of a strong online community (as can be seen by comments here and on Twitter) that will be very vocal if they see something unacceptable or offensive. I am thankful for that.