January 05, 2012, 1:19 PM — Today's post is about how easy it is to violate a stranger's privacy on the Internet. But it starts with Airbnb.
I have a rental unit I advertise on Airbnb, a travel site that allows vacationers to find cheap lodgings by renting directly from their owners. Ever since that disaster last summer when a San Francisco woman rented out her apartment via Airbnb and had it throughly vandalized, I've been a little hinky about using the service. Airbnb responded by making it slightly harder for scammers to create fake profiles by "verifying" their phone numbers and social media accounts. But as I pointed out in a blog post last summer, it's a system that's still too easy to game.
This week I got a request to rent my unit via Airbnb from a young woman (I'll call her Zooey S.) who had both her phone number and her Facebook account verified by Airbnb. Even so, I found myself wanting to know more before saying yes. So I decided to find out exactly what I could find out about her, given the information provided in her profile.
Her profile contained a photo, but it was taken a good 20 years ago when she was still a small child. It also included a chummy little note that mentioned what she did for a living and a few other vague details. Otherwise all I had was her first name and last initial, the city where she lives, the last two digits of her phone number, and the fact that she had a Facebook account with more than 400 friends.
First I Googled her name and city. The first hit was a Yelp account that may or may not be hers, but in any case had little info about Zooey besides her name and a photo. (However, her only Yelp friend is a big fan of a local medical marijuana dispensary.)
Second order of business: Find her Facebook account. I used Google to do a site specific search on Facebook for anyone matching her first name and location. (In this I was aided by the fact that her first name was a bit unusual -- if she were named Heather or Kristi that would have taken much longer.) The seventh hit was a Zooey S. who lived in the right city. Was it her? Hard to tell. The friend count was about right. She had made her posts and photos public (note: a lot of partying going on in those), as well as her friends list, her favorite sports team, and her tastes in music, books, and movies; but no real information about herself, her job, education, etc. So she was at least somewhat savvy about Facebook privacy.
Still, I now had a first and last name to search by. I Googled her full name and her profession. Bingo: Up popped a page on a professional services directory that was clearly her, and also listed a phone number whose final two digits matched the ones in her Airbnb profile. Now I could roam around her Facebook posts with confidence, hoovering up information -- like the fact that she recently got engaged, the name of her fiance, and where he just got a job. And, of course, I could call her, if I wanted.
But I wasn't done. Another Google search for her full name and city brought me to PeekYou, which confirmed her name with a middle initial, gave me her age, got a little more specific about her city, gave me some of her work history, and provided a link to her MySpace account (also not private -- lots more party pix). PeekYou in turn contained a link to Spokeo, which offered up the street Zooey lived on and its general location on a map, as well as the value of her home and her astrological sign, plus lots more info (phone, email, family members, age, political persuasions, social network connections, etc) if I was willing to pony up $3 to $5 a month for access to their public records search services. I declined.
By now I was starting to creep myself out. In 30 minutes or so I had gathered enough information to make this poor woman's life a living hell, if I wanted to. If I were a potential employer researching Zooey, I'd see red flags that would make me wary. If I were a criminal, I'd see copious opportunities to exploit this person (like by pretending to be an old friend who's overseas and in desperate need of cash). If I were a stalker -- at least, a real stalker -- I could have harassed her by phone and camped outside her house or place of work. And all I did to get there was a few targeted Google searches.
Think this can't happen to you? Think again, bunky. Latanya Sweeney, director of Harvard's Data Privacy Lab, has demonstrated you can identify almost any person on the planet using just three pieces of "anonymized" data:
Fully 87 percent of the United States population is uniquely identified by date of birth, five-digit zip code, and gender, she says: “So if I know only those three things about you, I can identify you by name 87 percent of the time. Pretty cool.”
Most of us have a lot more data than that floating around on the Web, free for the taking by marketers, data miners, advertising networks, stalkers, potential employers, and garden variety criminals. Zooey S. probably has less than most. She doesn't have a huge Internet footprint. I couldn't find her on Twitter, LinkedIn, or Google+. She probably thinks she's living a relatively private life. She's not.
And odds are, neither are you.
Got a question about social media? TY4NS blogger Dan Tynan may have the answer (and if not, he’ll make something up). Visit his snarky, occasionally NSFW blog eSarcasm or follow him on Twitter: @tynan_on_tech. For the latest IT news, analysis and how-to’s, follow ITworld on Twitter and Facebook.
Follow Dan on Google+
