Doxers can extract personal data from seemingly innocuous social media posts: Japanese experts


Users should be careful when posting graduation photos on social media. (Getty)

TOKYO – What do you reveal about yourself in your social media posts? Maybe more than you think. Japanese cybercrime experts warn that everything from chats about power outages to photos of graduations, backpacks and even bubble tea can unwittingly leak your personal information to the internet at large.

So what types of messages can be risky and what should people do?

“The user’s neighborhood can be discerned from things like pictures of diplomas, blackouts, and IC passes hanging from backpacks, even without the user knowing they gave anything,” said Yuho Kameda, 36, an engineer at a major Tokyo-based computer company. Service company SCSK Corp. Kameda and his colleagues have been hosting events for other engineers since 2016 to improve their information-gathering skills. Kameda creates training exercises that challenge participants to identify where a photo was taken – a type of “open source intelligence”, or mine and analyze publicly available data.

He first pointed to diplomas as “a type of social media post that users should be careful of.”

Personal information may be extracted from publications about a natural disaster. (Getty)

Many people post photos during graduation season, usually in March in Japan. Even if a graduate hides their name and that of their institution, the distinctive design and color of their diploma can help someone identify the school. Graduates may be excited to start a new chapter in their lives, but they should resist the urge to post pictures of the event on the internet.

People also tend to have a blind spot when it comes to posting about ongoing disasters, Kameda said.

“It’s particularly easy to extract location information from messages about lightning strikes because you can pinpoint where they occur,” according to Kamada. If a lightning strike causes a power outage, power companies clear the location almost immediately to notify residents, regardless of the extent of the outage. It’s the epitome of open information, and a social media user’s neighborhood can be identified from the time and what is visible in a posted photo. Additionally, a user’s location may be reduced to “within 10 buildings” depending on the extent of the outage. People should think twice before posting things like “There’s a power outage here”.

People may also need to pay attention to how their backpacks and bags appear on plans. Even if their faces aren’t visible, a photo of an IC pass hanging from a backpack or bag can reveal the station closest to their home, school, or workplace. Kameda pointed out that “even if the image is not clear, there is technology that can make it readable”.

The view reflected on the surface of a tapioca ball can help someone identify where the photo was taken. (Photo courtesy of Yuho Kameda)

In an exercise Kameda did for fellow engineers, even a photo of bubble tea held a clue to where it was taken. The location could apparently be discerned from the reflection on the surface of the tapioca balls.

Some self-proclaimed social media “doxers” — people who stalk and post the personal information of others online — get the information by analyzing seemingly innocuous posts. In one case, an obsessive fan tracked down a female pop idol in part by spotting the name of her local train station reflected in her eyes in a photo posted to social media. Later, he attacked and injured the woman.

And the ranks of online doxers are growing every year.

“There is a serious identity issue at stake,” said Daiji Hario, a professor of information science and profiling at Setsunan University. He continued, “What’s being done online doesn’t feel very real, but people are increasingly looking to fulfill their desire for real-world impact through social media connections. The feeling that “they change society validates their self-esteem, desire to dominate, and need for approval. Internet users are always on the lookout for new information and new stimulation. The growing number of doxers may reflect such feelings.”

So how do you protect yourself on social media? Hario advises maintaining the utmost importance of anonymity. You should set your privacy settings to prevent anyone, except those you have personally approved, from seeing your messages, as well as any disclosure of personal information, including your profile or even your profile.

Hario went on to say that people should blur the background of any photo or video they post on social media and avoid any post that simultaneously gives the time and location. In particular, posting things happening right in front of you on your commute can reveal part of your daily travel itinerary, increasing your risk of being targeted by a stalker.

Additionally, it’s important to regularly check past posts, Hario said. Doxers exploit targets’ social media feeds for personal information, so it’s important to delete even the dustiest of your old posts.

Also, it is best to avoid using the same account name for multiple social media platforms, such as Twitter and Instagram. If people find out that a person has multiple accounts, the risk of personal information being taken is higher. You should also use different account names not only for social media but also for other online services like Mercari flea market app for the same reason.

Searching for personal information like this may violate privacy, defamation, and other laws. Hario commented, “There are probably quite a few people trying to identify people online without acknowledging that they might be breaking the law. We need to thoroughly educate people about those risks.”

(Japanese original by Tadashi Murakami, Sports Information Department, and Harumi Kimoto, Digital Information Center)


About Author

Comments are closed.