Open Source Intelligence: Using Prudence to be More Private on Social Media

When I was a teenager, if a friend had a crush on someone, we went right to Facebook to scope him out. We got pretty good at finding pictures and information. And even if the target squeeze had some sense to use privacy settings, chances are his grandma did not. Little did I know that we were practicing “Open-Source Intelligence,” or “OSINT.”

If, somehow, by practicing the virtue of self-control and the grace of God, you haven’t “Facebook stalked” someone, I’m sure you can think of an investigation montage from a movie or TV show. Someone sits at a library reading books, newspaper clippings, and homing in web searches to solve a mystery. A group of investigators look at security camera footage, enlarging and enhancing a reflection or shadow a laughable number of times to find the bad guy. 

Sometimes topics in cybersecurity seem foreign and complicated, but this is something we can all understand. And it’s very important for your loved ones’ dignity and safety—but more about that in a minute. 

What is OSINT? 

First, a definition: OSINT is the process of collecting and analyzing information from publicly available sources. There are physical sources like newspapers and magazines and digital sources like social media posts and Google searches. See, this is not scary or complicated. The jargon and tech tools professionals and hackers use are overkill for our purposes, so thankfully we get to skip all that. 

Privacy v. Publicly Available Information

Privacy is defined as being free from observation, freedom to be alone, and freedom to choose what information you keep secret. Privacy is the opposite of publicity, that is, things publicly available. 

Privacy is a human right. It’s something gifted to us by God, codified in many governments and international organizations, and modeled by Jesus. He showed us the importance of going “to a desolate place” to pray alone with God (Mark 1:35). Human dignity requires that our privacy be respected.  

Even with the human right to privacy, we need to give up some information to participate in a social community. If I go get coffee with a friend, I expect the public to learn certain things about me. They will see how tall I am and my hair color. If I talk loud enough, they might even know what kind of coffee I like and where I got my earrings that the barista so kindly complimented me on. But everything else, I choose to keep private. 

What is Publicly Available About Me? 

There are some things out of our control like court documents for marriages, divorces, and arrests, names on closing documents from buying a house, and phone books already in publication. 

There’s also information on innocuous websites about us. Our names and pictures very likely appear on school honor rolls, product reviews we wrote, local news articles at the county fair, and the like. And for the most part, we don’t care that it’s there. A quick Google search will give you an idea of what’s out there. 

Or you may want more privacy for yourself and for your family. If you feel called to take your privacy to the next level, I recommend this book: Extreme Privacy: What It Takes to Disappear by Michael Bazzell. And as always, if you need help implementing any of these ideas, just reach out to [email protected] for more information and guidance. 

Prudence Using Social Media 

If prudence is the habit of sound intellectual decisions in practical matters, we need to educate ourselves about what is really happening to our information when we use social media. 

Your social media posts and pictures say a lot. And you might not realize it. That’s a big deal when the information could be about your identity credentials, your kids’ locations in real time, or your plain and simple privacy.

“Personally identifiable information,” or “PII,” is an important term for OSINT. It is information that can be used to trace or distinguish an individual’s identity. Examples of PII are names, birthdays, biometrics, and social security numbers. You might not realize that computers and phones track an insane number of datapoints about you and even things like usernames, search histories, video playlists, and work done online are all considered PII because they can be traced back to specifically you. You can read more about digital identities here. 

The safest way to avoid risks associated with social media is to just delete it. Any social media presence opens you up to both security and privacy concerns. But like any social community, you can choose to give up some information in order to participate. Here are some tips to help you make an informed decision before you share information. 

Practical Social Media Habits to Build

First, consider the PII you’re disseminating about yourself in your profile and group interactions. Facebook and other social media platforms allow you to list family members, work and education history, location, and to select your favorite sports teams, music, TV shows, etc. Decide for yourself how much of that information is truly private or if you want it to be public. 

You may not have considered that your groups are also PII. Joining groups can reveal your interests, political views, products you own, artwork you create, where you are an alum, what year you graduated, and your religious views. Your group affiliations can even tell the world the method of NFP you use and when your baby was born. It may be helpful to gain inspiration or a sense of community with people in similar stages of life, but you need to weigh this sacrifice of privacy with the interests of your online communities. 

Another category of information being shared is your metadata.  Metadata is defined as data about other data. It includes the date, time, and location of photos, it can include data on filters or effects added to photos after being taken and includes the device you took a photo on. Cue the OSINT professional and hacker tools I mentioned earlier. They can easily use your metadata and triangulate your social interactions with others who don’t have as tight of privacy controls as you to learn more about you than you thought you were sharing.

As for photos, build the habit of a critical eye for PII in your pictures. A picture of your lunch is innocent enough. But what if also in that picture is you, wearing your work badge, with your work friends, at an identifiable restaurant, with a slice of birthday cake? Suddenly that innocent picture now shows where you work, what your badge looks like (in case someone wanted to make a phony copy), who you work and associate with, where you were, and when your birthday is. 

Consider another example. Last week my husband and I were watching a compilation of funny home videos on YouTube. One video was taken by a living room security camera showing something sort of funny, I don’t remember the details. What I do remember is that behind the family on the wall was a large display of all the family member’s names on intersecting scrabble tiles, and next to that was a sign with the couple’s last name and the year they were married. 

I was amazed by their lack of concern for privacy. The person who sent in their home video wanted to participate in the social community of YouTube, but wow did they disseminate a lot of PII to do so. These are the kind of information surrenders you should be thinking about when you post on social media. 

Something you can do right now is go to your social media accounts and check your photo permissions and privacy settings. Make sure you only allow access to the photos you select, not your entire camera roll. Next, you can check that your profile is only viewable by the people you know, not everyone. Additionally, you can remove access to your location and contacts. 

Family Values: Decide for Yourselves

For those of us on social media, we need to be virtuous and good stewards of our family’s information. Not just because a hacker could use OSINT to learn about your family, but because privacy is a human right. It ought to be your informed decision how much you choose to be private and public. Do not use social media blindly but be educated and prudent. 

Talk with each other as family leaders about your specific family values. Will you use your real name on social media profiles? Will you post pictures of your children? What about pictures of your children that reveal their school or club activities? Will you be active in groups or only use Facebook for marketplace? Talk about what you wish to gain from social media, and what information you are willing to give up in order to participate. 

Then, be sure to communicate those values with extended family like grandparents and aunties who you share pictures with. 

An Examination of Conscience Before Posting on Social Media

As a summary, here is an examination of conscience before posting on social media considering both your privacy and your spirituality:

1. Who

   1. Privacy. Who am I friends with that will immediately see this post? Are there strangers in this group who will see this? Am I okay with this being shared to someone I don’t know? 

   2. Spirituality. Am I posting this to brag to certain people whose opinions I care about more than God’s opinion of me? Am I posting this to seem holy? Am I posting this to seek pity or attention? Does my “venting” post include libel about my family or am I delighting in the brokenness of other families doing the same? 

2. What

   1. Privacy. Am I violating the dignity or privacy of someone else in my pictures? Am I posting pictures of people who have not been given the choice to keep this private or public? Am I revealing PII unnecessarily? 

   2. Spirituality. Am I posting anything scandalous or promoting something not in line with the church’s teachings? Am I posting this to impress people with my things, wealth, or achievements, rather than impress upon them the importance of God? 

3. When

   1. Privacy. Am I posting a picture on vacation while I’m there, letting the world (including burglars) know I’m out of the house and will be for the next two weeks?

   2. Spirituality. Is the first part of my day spent on social media or with God in prayer time? Have conversations or interactions online with strangers become so important to me that I think about them during mass or prayer time? 

4. Where

   1. Privacy. Am I posting PII about my home, school, or workplace? Am I posting PII about my family’s participation in clubs, sports, or lessons, revealing predictable locations of myself or my family? Am I posting this in a doctor’s waiting room, and thus revealing metadata I’d rather keep private? 

   2. Spirituality. Am I posting this to brag about my travels? Am I posting this with a disordered care for my status in clubs and organizations? 

How Does OSINT Promote Truth, Beauty, and Goodness? 

And now to finish on a positive note that technology can bring truth, beauty, and goodness to the world, there are nonprofit organizations like Trace Labs who search for missing persons using OSINT tools. Volunteers put their skills to work to investigate cases and work with law enforcement to bring missing persons home, fight human trafficking, and heal broken families. At the time of writing, Trace Labs has assisted in 492 cases. Thank you to all those who volunteer their time and talents to go looking for the lost sheep. 

Please join me in praying for an end of human trafficking, an increase in the respect for all human life, and generosity in the hearts of those who can help find missing persons.

St. Anthony, pray for us. St. Josephine Bakhita, pray for us.