Your social media is a criminal’s intelligence file

I remember presenting to a major global bank twenty years ago about the dangers of social media and particularly Facebook. My thinking was that I could find one of their senior managers in a branch or call centre and discover, through their posts, everything about them. Their phone number, where they live, their partner’s details, their friends and family and possibly their house and location.

The idea would be to then arrive early one morning around 6:30 and gain access to the house, threaten the target with killing their children named John and Jane, as I’ve done my homework, and tell them to get to the bank and bring back all the cash.

It was an idea that was a bit fantastical until the big bank boss said to me that this story had actually happened to one of their branch managers. Not so fantastical.

The point I was making twenty years ago was that social media had created something fundamentally new. We were voluntarily creating intelligence files about ourselves and publishing them on the internet. Criminals no longer needed to follow you around, search your rubbish or employ a private investigator. You told them where you lived, where you worked, where your children went to school, where you went on holiday, what car you drove, who your friends were and, occasionally, when your house was empty.

In fact, your updates during a holiday would be the perfect time to break into your house and nick everything.

Which is why I was interested in an update from Sussex Police Force today about the dangers of social media for everyone. Posting what looks like a lovely picture of back-to-school day, they point out that mum hasn’t realised she’s given out her address, children’s school details, car number plate and her name on one innocent photograph.

Source: https://www.instagram.com/reels/DcvSbBlu5qv/

None of those details look particularly dangerous on their own but put them together and they create a profile. Put that profile together with everything else you have posted over the past five or ten years and you have created an intelligence dossier.

And now we have AI.

That changes the game again because the criminal no longer needs to spend hours trawling through hundreds of photographs, posts, comments, likes and connections. Machines do it. They connect the dots, identify relationships, recognise locations, reproduce voices, manufacture photographs and videos and create convincing messages from people you know and trust.

In other words, social media created the database and artificial intelligence is creating the engine for exploiting it.

This is also why social engineering remains one of the weakest points in cybersecurity. We spend billions protecting systems, encrypting data, securing networks and authenticating users, but the easiest way into many organisations remains remarkably simple: persuade a human being to open the door.

And we are making that persuasion easier by publishing our lives online.

So, a few simple rules.

First, don’t post things that everyone can see.

Second, if you are posting things everyone can see, look carefully at everything in the photograph, not just the thing you intended to photograph. Street names, house numbers, school badges, number plates, computer screens, identity cards and documents all tell stories.

Third, constantly check your security settings to ensure everything you post is private unless you deliberately choose otherwise.

Fourth, remember that every innocent post becomes another piece of data about you. One photograph tells very little. Ten years of photographs tell almost everything.

Fifth, take pictures in front of your neighbour’s house.

Only joking.

Although, thinking about it …