Unspoken Security Ep 25: Inside the Data Broker Industry: Privacy Risks & Realities

If you're looking for extreme privacy and security, there's a lot of cost and the cost really is just time. It's just very, it's a lot of work. It's like why is, why we have big cybersecurity teams? 'Cause it takes a lot of effort, a lot of expertise, but something is better than nothing and you kind of can just start somewhere and get better and better at it. But I think there's just a lot of the typical things that you would look online and do some kind of like basic research, like ways to protect yourself. I think one to start with, is just like the, the, the 80/20 is just don't recycle passwords, you know, and use a password manager and don't make it so that you're using the same password for, you know, 50 different websites and, you know, can, can find one of those in a breach and then they can log into your LinkedIn and your Facebook and your bank, et cetera.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most of important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I've spent 19 years in the intelligence community, mostly at NSA. Been building and maturing intelligence programs in the private sector for about 8 years. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. This podcast brings all of these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not going to be the typical polished podcast. My dog makes occasional appearances. She's not around today, I don't think, but who knows how the day goes. People argue, we debate, we can even swear here. I'm certainly going to do my fair share, I'm sure. And that's all okay. Think of this podcast more like a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences that most of us go to. These are the conversations we usually have when nobody's listening. Now today I'm joined by Lawrence Gentilello, founder and CEO of Optery. Optery is a company that automatically removes customer data from hundreds of data brokers posting and selling your information online. Lawrence presented Optery at TechCrunch Disrupt Startup Battlefield in 2022 and as a finalist at South by Southwest Pitch in 2023. Hundreds of thousands of people use Optery to prevent attacks and keep their personal information off the internet. Prior to founding Optery, Lawrence led Accenture's data management platforms practice in North America. And prior to that, he was product management and technical consulting leader at Oracle and Bluekai, who was acquired by Oracle. So this is Gary's background, or this is— I apologize, this is Lawrence's background. I'm off to a great start this morning. So this is Lawrence's background. This is what he knows best. And all of us are affected, in my opinion, by data brokers, whether we know it or not. That being said, Lawrence, anything you want to add to your profile that I missed?

No, I think that's great. I think you captured it well. I think just on, maybe on a personal level, I live in the San Francisco Bay Area, in the East Bay for those that are familiar with it. And really excited to talk today. Thanks for the generous intro.

Yeah, absolutely. No, thanks for coming on. I mean, I, this is a really interesting topic. I think most people, frankly, maybe all people, but most people are affected by data brokers, whether they know it or not. You know, if you're getting spam emails, if you're getting spam text messages, if you're getting almost anything sent to you that you don't want, there's a good chance there's a data broker involved at some point. You know, above and beyond that, there's obviously a lot of criminal activity that's tied to a lot of these things, right? So I, I think it's important to talk to make sure everybody understands who we're talking about when we say data brokers. You know, whether these are, are we talking about criminals? Are we talking about something that's legal? So, you know, I think talking to you as an expert, Lawrence, I think the easiest question to open with that everybody should be on the same page is what are data brokers? When we talk about them, you know, what are we saying and why do we care? Why should we care about these data brokers?

Yeah, definitely a great question to kind of start off the conversation. Yeah, so the data broker industry is vast. Tens of billions of dollars change hands by the buying and selling of consumers' data by data brokers. And data brokers as defined are companies that buy and sell people's information that they don't have a direct relationship with. So for example, a lot of online dating apps are data brokers, sorry, data sellers, and they might sell the information that they have about the people that sign up for their free dating apps. And then data brokers buy that information and sell it. So the data broker is the one that buys the information for the data dating apps, and they might sell it to an e-commerce company that might be looking to sell you new clothes because you, they, they know you're in, in the market for dating. And they want to send you, sell you more, more stylish clothes. Or maybe for gym memberships to say, hey, okay, this person is actively, you know, dating and so they might be interested in staying physically fit. And so the data broker would purchase information from the, the dating app and then it would sell it to typically marketers. But the data broker industry goes beyond just marketing, although that's probably like the, the core of what it is. Data brokers sell data to politicians for their, their political campaigns. For analytics and all types of things. It was sort of like everything under the sun. But that's what data brokers are, is companies that sell information that they don't have a direct relationship with.

So it's interesting. So you mentioned dating, dating profiles, right? So, and you know, I think we've all probably heard this at some point, or at least a lot of people have, right? If, if something's free, it's probably not free, right? You know, the old story with apps, with software, you know, with any sort of thing is if the product is free, then you are the product. You know, whether it's social, a lot of it's social media platforms, right? Facebook's free and Twitter used to be free. Now I guess it is to a point, but they've changed the policies a bit. But if it's free, it's because they're getting something else, right? They're either, it's either to build a base so they can advertise and or it's to buy, sell, trade, use your data, right? So, but it's interesting you talk about dating websites. I'm not sure a lot of people think too much about that, you know, and you already made some connections that are actually a little more advanced in that it's not just about. Buying the user information from the website, but what it can be turned into, you know, not, it's not just about spam on irrelevant things, but again, if somebody's dating, if they have a new profile, you know, yeah, they probably want to look and feel better, right? You know, they're going to work out. They're going to, they're going to wear new clothes. They're going to, I don't know, buy a new car maybe, or perfume or whatever it is that's going to make them more attractive, right?

That's the idea.

So, you know, it's interesting. So, but if I'm hearing you correctly, what you're saying is all these companies, all these platforms, that are building, you know, environments for us to join, to, to be communities. They're not necessarily the ones that are the direct sellers. It sounds like the data brokers, if I'm hearing you correctly, they're getting the data from all of these different platforms and then they're correlating that into one larger database, which it seems like could make all sorts of interesting connections then. So it's, I've got a new job, I've got a new relationship, or I'm thinking of starting one, maybe I'm ending a relationship or getting divorced or I'm moving. There's a whole lot of pattern of life. We used to say in the Intel community, there's a lot of pattern of life you can develop if you have all of this different data, you know, that's correlated. Is that something also that data brokers are involved in when they're selling? Are they just selling credentials and, you know, usernames and some basic things? Or are they selling these more advanced correlated datasets?

Yeah, I mean, it's really everything under the sun. Data brokers themselves get a lot of their data from public records databases. So real estate transactions. Where somebody lives or whether or not they own a home, the value of that home. Is that home worth $200,000? Is it worth $2 million? Is it worth $20 million? What zip code do you live in? Do you live in a zip code that is, you know, maybe primarily families? Is it primarily retirees? Is it, you know, young, you know, urban professionals, et cetera. So real estate and public records databases is one big input to Data Broker datasets. Other one is just what's available on the open web. So us, you know, one of the things that we can do for ourselves to protect ourselves is to limit the amount of information that's just sort of like publicly out there on the open web. If it's on the open web, you can kind of just consider it fair game for data brokers to scrape and collect. Most people leave their LinkedIn profiles, for example, just open. They have the, the, where anybody without a LinkedIn profile can find out where you work and maybe where you used to work and what your title is. Data brokers are constantly hoovering up that information. They're hoovering up pictures that might be on the public open web. So just kind of like open web stuff that maybe other people posted about you and maybe stuff that you've posted yourself, typically through social media. The other big source is like we talked about the dating apps, but like a lot of the apps that are popular in app stores and that we use on our phones are common sources of data. So even like a lot of weather apps, like the fancy flashlight apps on your phone, oftentimes they're selling what your location is. So they, you have that flashlight app on your phone that you download that does not native onto your phone,, they will be looking at your GPS coordinates and sending that out to somebody and they're gonna know, they're gonna match that up to which stores that you enter. Did you enter a Volvo dealership, a Toyota dealership, a Honda dealership? That information, you know, gets sold by data brokers that specialize in location data. Those are a few examples. The list is vast. It just, it kind of touches every aspect of our lives.

And this is legal, right? I mean, data brokering is a legal business. You can acquire this information from the apps. And I think a lot of people don't realize, you know, you mentioned the flashlight's a good example, right? I think most people don't realize how many apps are on their phone. First of all, how many they just downloaded, right? We get lots of free apps and what the terms are that, that go with those apps, right? There's so many apps. You go back and look, and I've had previous conversations here in other places where I've said, you gotta go back and check the permissions you've given when you've downloaded an app, because you'll find out there's an app like a flashlight. Okay, I want a flashlight app because I want to be able to see better, I guess. It doesn't need to have access to my pictures or my contact information or my geo, you know, geopositioning, right? It doesn't need access to these things. I just wanted to turn on and show something in a different color. I guess, I don't know. I don't actually have one of these, but it's interesting. I think people don't realize when they download things how much security, how much privacy they just give away. Like they just, they don't read the terms. They just click things and get whatever it is they want. And then this is all again perfectly legal, right? These companies are able to pull this stuff together and then sell it to— now here's the question. Do they sell it to just anybody? Like, can anybody walk in and buy it? Do I have to have a license? Do I have to have proof I'm a valid business? Can anybody get ahold of a data broker and just be like, hey, I wanna buy, you know, all the data on an individual or a group of individuals or a geography? I mean, how does that work?

Yeah, pretty much anybody can buy this data. And there's been some laws recently, I think, that are restricting the sale of information on people in the military and people in the government, because there was certainly some examples where, you know, nation states are just sort of buying up lists of people and information on people that are in the military. I don't know if that's passed or not, but I think there was a law that was somewhat recently passed that restricted the sale of that information. But everything else, it's like, pretty, pretty much just like open for business. One of the, there's a lot of different categories of data brokers. One of the ways that we categorize data brokers is people search sites. So people search sites are like, if you, you know, perform a search engine search for someone's name and address, you might be able to see, okay, there's a profile about them. It's got their home address. It's got their family members' names and maybe some like information about them. Some of the big names there is like InstantCheckmate, WhitePages.com, Spokeo, SpyDialer. Stuff like that. Those companies, you just can go and buy background kind of reports on anybody. There's no restriction. You have a credit card, you have a PayPal account, they'll sell it to you. It doesn't matter where you live and who you are. So there, there's that. And then there's a, the other big category is we refer to as B2B prospecting databases. So this would be like ZoomInfo, Apollo, RocketReach, Clearbit, ContactOut. And tho— that data is typically used for cold outbound email campaigns and like text message and phone campaigns. So typically you have a lot of B2B SaaS vendors that buy, you know, lists of cybersecurity decision makers or maybe like, you know, IT decision makers or maybe HR professionals. And then they'll, you know, queue up, you know, a list of 400,000 people and batch and blast them into email sequences. Again, there's no restrictions on who can buy that information. A lot of those companies have free tiers where you can get like your first 100 contacts for free. Really just anybody can get them and you can just create an account and just sort of use the free tier and believe anybody in the world can do that. Again, I do believe there's now being some restrictions put in place for military and public officials, but probably pretty easy to skirt those things if you wanted to.

Yeah. And I mean, I'm familiar with some of the websites you mentioned. Listen, there's valid reasons for these websites too. You know, people use them. Skip tracers certainly use them. Some people who are bill collectors, people who are tracking down, you know, legal bounty hunters, you know, skip tracing. It's a valid set of databases that's needed, right? I do a lot of OSINT work. A lot of intel folks do. And so I, I've, you know, I admit I've got accounts at a couple of these websites you mentioned. So I'm familiar with it and they're very useful. They're also frankly, in the private world, kind of useful if your friend is dating some new person. It's nice to go do a little background information and check on them and see. You know, if they have a criminal record or if they are who they say they are, if they live where they say they live, if they're married, those kinds of things. So there's valid uses for these, but you know, it does open up for a lot of abuse. And I think it's a thing people need to understand is just how readily available this data is and that it's legal. And a lot of it is because, you know, we're the ones as consumers who are making this happen, right? We're giving our information away. Now, as you said, you know, LinkedIn profile open to everybody, which mine is too, and sort of has to be. It's the whole point of networking is you have to be open to people. If you're only networking with people you already know, it's very hard to create a larger network. But then you got to be careful on what you're posting and all their social media, whether it's Facebook or Twitter, you know, take your pick and certainly the dating sites. So I think it's interesting that this is such a vast industry that has spawned another industry, right? I mean, industry where you exist, where Optery is, right? So there's so much of this going on that now we have a whole nother industry that's combating the problem that, that grew out of this, you know, this ability to collect all this information and sell it and make money off of it. Possibly put people at risk. So with that in mind, you know, you've been doing this for a while now. What do you see as growing trends or the threats in this space? Now we know this is legal. We know that people can pull this stuff together. And as you said, there's some laws in place maybe to try to protect a segment, at least of society, government officials, military, whether that's effective or not, hard to say. But what do you see as growing trends and threats, you know, in this space when it comes to personal information being collected and, uh, consolidated and, and sold and used?

Yeah, definitely. And even just to respond quickly to something that you mentioned is that by and large, this is legal and the data that data brokers sell provide a tremendous amount of liquidity into our economy and our society. So some data brokers are the credit, the credit bureaus like TransUnion, Equifax, and Experian. They sell, buy and sell data that we don't give to them directly, but they help you where if you go in to buy a car and you need a loan and you can, you know, they'll, they'll be able to provide a credit score if you need to take a credit card, you need to purchase a home. So there's a lot of liquidity that these data brokers provide. Also, you mentioned, you know, real estate, you know, landlords often will use them to say, hey, is this person, you know, a, you know, can I tell them about this person before I rent a home to them? So there's definitely a lot of value that they provide into the system. And I think that's one of the reasons that it's been really challenging to get federal privacy laws passed. And even like the laws that we have at the state level, are often a little bit watered down because I think politicians are a little bit worried and scared that it will seize up, you know, pieces of the economy if that those datasets just go away. But, you know, to your, to your question around the, the trends, I think one of the big things, and actually, so when I started Optery with my co-founders in 2020, that was when California had just the California Consumer Privacy Act, which is the first US consumer privacy law that went into effect. Now we have, I think like around 10 that are in effect. Texas has a law, Oregon has a law, Connecticut, Colorado, Utah, you know, and a few others, which is really exciting for us and just like for me personally. But at the time, that was really groundbreaking and, you know, really revolutionary that, that California passed the law. And one of the biggest trends I think today is kind of like the haves and the have-nots. In the world of privacy rights. There's become a divide in this country of who has rights to privacy and who does not. So if you live in one of the approximately 10 states that has a privacy law, you actually do have tangible rights to tell a company, delete my data, do not sell my data. But if you do not live in a state that has a privacy law, you literally have no rights. And so we, when we submit opt-out and data deletion, data removal requests for our customers, the effectiveness of our requests is much higher when our customers live in those states that have privacy laws. And it's a little bit lower in cus— for our customers that don't, that live in states without privacy laws. So there's definitely a divide that is happening. And as the pressure has been put more firmly on data brokers, they're now kind of treating people differently based on what state they live in. And so you have all these different divides in societies, and this is a, a divide that is really happening here in the United States is if there's a privacy law that you have backed by or not. So that's one, I'll just pause there, but that's one, one thing.

Well, I mean, I think it's interesting, you know, it's one of the challenges we have in the country about a lot of laws, right? Is the difference between federal law and state protections, right? So I know that's a, big in the news right now over a whole lot of other issues as to, you know, one states have different laws than other states, and we'll save that for a different conversation. I don't want to derail, but I do think it's interesting that as consumers, that means we have to know the laws in our own states. You know, there's a lot of, there's a lot of personal responsibility that gets put on this. It sounds like you need to know what companies can and can't do with your data. I mean, assuming you want to protect yourself, I guess, and, you know, putting in the effort is understanding what companies can and can't do with our data. And it is different by state. And listen, I'm gonna be honest, I live in Minnesota. I have no idea right now, having this conversation today, I have no idea what laws we have on the books. I'll probably be reading up on this now afterwards. I know earlier this year, and I imagine you know about this, I don't mean to put you on the spot, we didn't talk about it in preparation, but I know there had been a Protecting America's Data from Foreign Adversaries Act, right, that was signed into law earlier this year, right? President Biden signed something in April, it sounds like, that was supposed to take effect in June. How does that work in all this? Assuming you're, you're very familiar with the law, and if you're not, I apologize and I'll probably just cut this out at that point so nobody knows. But is this a law that, that protects us better since it is at the federal level, or is there a lot more work still beyond that?

I don't know the details of that, but I think that's the law that I was referring to that protects people in the military. So I think that is like, intended for, you know, foreign adversaries from easily just purchasing information on, um, our military personnel. I think that's what it is. I'm not 100% positive.

Okay. I, I listen, I'm cheating for anybody who's not watching. If you're watching, you're probably seeing it. If you're listening, you're not. I'm cheating. I'm actually Googling this. This is something I've said I would do in the show and I rarely do it, but this is such an interesting topic that I wanted to Google this one. So I'm actually going to read a bit of it. It's PADFA, the Protecting Americans— what did it say now? I've already lost track. Protecting Americans' Data from Foreign Adversaries Act of 2024, the PADFA Act, for anybody who wants to know. So according to this, actually, this is a little more protection. Theoretically, the act establishes new restrictions as unfair or deceptive acts regulated by the FTC on transfers of certain personally identifiable sensitive data to foreign adversary countries. Apparently it seems to protect all Americans in this case. It says PADFA prohibits data brokers to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available PII, personally identified, identifiable, sensible, personally identifiable sensitive data of a US individual to any foreign adversary country or any entity controlled by a foreign adversary country. Now the countries listed here are just China, Russia, Iran, and North Korea. So it is still somewhat limited. So that's, I, this sounds like good news in that at least the government is looking, it's a segment, right? It's a very small piece. This was signed in June. That says these data brokers can't sell any American's information to these 4 nations. Now, I assume there's third-party cutouts and there's a whole lot of ways still to get around this, but at least there's some encouraging information that the federal government is looking at this. But it still sounds like from what you're saying, there's a long way to go. States have their own laws and we probably have to get ourselves smart on this because the government is trying to catch up. It doesn't sound like we're there yet from what I'm seeing. So. Anyway, that's a new law. I didn't mean to put you on the spot.

And yeah, that's great. I think, yeah, I started mixing it up with a different law, but that's great to hear. Okay.

Yeah. And I'll look up the other one too.

You asked about Minnesota. So Minnesota, I believe that law has passed, but it doesn't go into effect in like July of 2025. So usually the law passes and then they, you know, give day brokers a year, 6 months, 18 months, 2 years to kind of get their affairs in order for that state and to start to comply. So. In, I think it was in July of this year, 2024, Texas and Oregon went into effect. I think just this month, Montana went into effect. Maybe that was last month in September. It was either last month or this month. And there's a bunch of more states that go into effect next year. Minnesota, I believe, is July of next year. So there's a big backlog of them. Every few months, more and more go live.

Is there, as we're going down this rabbit hole a little bit, do you know offhand? And again, if you don't, it sounds like we have to do our own research as consumers. So I'm just curious, like, is there a database that's helping right now? Say, hey, here's the laws by state. Or do we, are you guys, are you having to piecemeal this stuff together? I mean, maybe you guys wrote a blog on it. I don't know. It's your business, but is there a place where I could go and say, okay, let me look up the laws for my state, or do I actually have to go Google each state, you know, and, and find it out for myself?

Yeah, it's a great question. And this is one of the challenges for consumers, for businesses, really for everybody, is that we have a patchwork of state privacy laws. We don't have anything consistent at the federal level. And the place that I go to, I have a, page bookmarked at, on the IAPP's website. It's the US State Privacy Law Legislation Tracker. You could search for that on the web and it's got like an up-to-date listing of the different laws that have passed and when they're going into effect, if they haven't gone into effect. And then you can like click on the state and then you could go and get a detail, like what's happening in that state. So that's usually like, hmm. My starting place to, to kind of just get a quick sense. I get like, oh, I can't remember, is, is Minnesota live or not? I'll just go there really quickly and you can get a sense. And then the IAPP also has, you know, some PDFs you can download that have these like matrix grids that say, you know, have all the different like typical attributes of a privacy law and whether or not it's valid in that state or not. So that's my go-to, but any web search, you'd probably be able to find some trackers, privacy law legislation trackers.

This is actually really good. So again, I'm taking more advantage of Google today than usual. I've looked this up while you were talking, the IAPP, and I will, so in our show notes for this show, I'll provide that link to folks who've listened or watched. So you don't have to look for it. It's iapp.org with a whole bunch of words after it. Don't worry. But I will actually drop this link. I think this is really interesting because it does have this chart and I'm looking through and like Minnesota's is HF 4757. I guess is the law going into effect here, July 2025, for instance. So really interesting stuff. I'm going to, I'll add this link into our show notes for this episode so people can have that because it is difficult, isn't this? It's hard to keep track of these laws and it's important that we know how to protect ourselves. So, so thanks. I, that was a little detour we didn't plan for in advance. So I put Lawrence on the spot, but you know, as any expert would, he did a great job obviously. And, and thanks for, for helping us with that. So, so finishing up where we were, cuz I sort of derailed a little bit to talk about the laws, but the trends that we're seeing, right, with these attackers and these groups, is there anything more you wanted to add to that as far as, you know, things that we're seeing that are most dangerous, you know, things, you know, generative AI getting involved in some of this stuff and some of the other things that, that we should be knowing about, even if we can't do anything about it necessarily, but things we need to be aware of how this data is being used and what you're seeing as trends or even what you're seeing as potential things that you're looking for on the horizon that maybe haven't happened quite yet.

Yeah, definitely. I mean, you know, in today's day and age, you, there's always like, what's the AI angle, right? Like, what's the AI angle here? And, and certainly like there's an AI angle here and that's a big trend. One is the use of AI by data brokers. So data brokers are almost by definition, typically pretty innovative in terms of, you know, they're handling datasets with hundreds of millions of people. And then, you know, each of those individuals, they might have dozens or hundreds or even thousands of attributes about those people, you know, maybe past purchases that they've made, past places that they've lived, people they're associated with. I mean, this just goes on forever. So data brokers as a kind of a category are typically pretty skilled with big data and like large data sets and manipulating and drawing the kind of insights, inferences from data. And so it would only stand to reason that they would begin to leverage the latest technologies in AI. And so definitely one of the things that we're seeing right now is kind of like a new class of data brokers that's emerging. That's kind of like AI native in a way where they're not just using older kind of just standard database technologies, but they're using AI to determine kind of like the different likelihoods of things that you might do. Like, you know, based on all this past information about you, like here's, um, a much higher, greater, greater like likelihoods that you might perform future actions. Also just kind of the creation of more intelligence, intelligent audience segments, for example, and even just ho— housing consumer data in AI systems. So that's like a big factor is kind of like more like AI-native data brokers. And then just the utilization of AI technology by data brokers. So that's a, a really big trend that we're seeing. So that's like, I think, pretty key. And then the next question is, well, what can you do to, to protect yourself from that. And one is limiting the amount of information that you voluntarily or inadvertently relinquish out into the world for those companies to potentially use against you by minimizing your online, your digital footprint and being really careful about what apps you install on your phone and, you know, just their, your data, the data trail that you leave behind. But those would be a couple of big trends that, that we're seeing.

Yeah, that's interesting because obviously, as you mentioned, you know, now there isn't a topic that the question isn't going to be, well, where does AI fit in, right? AI is everywhere. It's everything. It's going to solve problems or cause problems or save the world or ruin the world depending on who you ask. And so it all fits in there. But, you know, one of the things I'm looking at a lot of times is misdis and malinformation, you know, generative AI, you know, creating false, false personas, false impressions, false messaging all the way across the board, you know, to things like extortion campaigns and things of that nature, right? So it would seem to me the more information you have on somebody, the better profile you can build on them, the more convincing scams you're gonna be able to pull, right? You know, whether it's something as simple as, again, having the right phishing email or, you know, smishing text message that hits somebody at the right time, at the right place because you know they're selling a home or because they're, you know, in a new relationship or cuz they're in a specific town or whatever it might be. But also the more, more nefarious pieces of being able to use information combined with generative AI. For some of the scams, like phone calls that impersonate a child in danger, or, you know, the boss demanding money or, or any of these things. You know, is it reasonable to think that the data brokers unintentionally, it's not their responsibility, but is it reasonable to think that by selling data to anybody, essentially, that they are probably helping criminals to build better campaigns for these kind of scams?

Yeah, definitely. I think that's another big trend. Uh, what you just, you know, identified is just the increasing sophistication of attackers. So attackers and attacks are becoming more data-driven. So they're utilizing data about individuals to more kind of personalize and customize and craft attacks to make them more effective. And so also, I guess the other piece of AI is attackers are using generative AI to impersonate voices, as you mentioned, even like physical attributes and video. Avatars and then leveraging data that you might kind of have put out there to inform the things that your avatar or your fake voice is, is saying. So the sophistication of attackers and leveraging of data is absolutely a huge trend. I constantly remind my mother who's not quite as tech savvy to be on the lookout for anything. And I've sent her, I've played around with cloning my voice, like with an AI, you know, tool. And I sent her like audio clips to, to show her of me like talking and basically saying, you might get a phone call that from somebody that sounds a lot like me asking you to wire you money, or asking you, you to wire me money because I'm in some kind of a dangerous situation. Don't do that, you know, right, right away. So that, those types of risks and, you know, attackers might, start to assemble information like, well, what are your parents' names? What are your kids' names? What are images of them? What can we get them on audio? We can clone their voice. And then not only that, but just increasing the scale of the attack. So if it's more kind of manual and kludgy, you can only, you can, you see that you can do one of these a day, but with AI and technology, you might be able to do hundreds or thousands of these a day. So it's, you know, our data, can be used for us, but it can also be used against us.

Yeah, it's interesting you talk about the discussion with your mother. I just recently had a similar conversation with the family because we're seeing this, right? And so I've had this chat about if any of us in the family receive a call from anybody else in the family, you know, I'm in trouble, I'm in need, et cetera, to be wary of that. I spoke recently at a conference here in Minneapolis and the guest speakers, friends of mine, actually asked permission because they were going to do a demonstration on generative AI and some of these things as it applies to physical red teaming. And they asked permission to use me. And I said, sure, go ahead. I mean, there's audio and video out there. Feel free. And they put something together and then I sat in the back row while they gave their presentation and they had what appeared to be a live phone conversation with me. They had, and they were asking questions. The AI was answering in my voice and had a full conversation going with an AI that was suggesting they were in, in danger, in trouble, they needed help, et cetera. And I'm in the back row sitting there and I had to, of course, let people know this was not staged. This was not done in advance. I did not record this. And they, to be honest, they didn't put that much effort into it. It wasn't great. It was really sound, I think, but they said that we didn't put much effort into it. So I recently had this conversation with my own family and said, hey, listen, we've got to be aware of this. It's hard because people are going to do this in stressful situations. We've just had a car accident. We're in jail, you know, things where you just don't want to question people. You just want to help them. And in our case, frankly, you know, we've got a family password, basically something that isn't posted anywhere. It's random. And it was like, you know, no matter how horrible the situation is, if the person can't remember the password, we've got to question it. Now, I don't know if that's really going to hold up under duress, if I'm being honest. You know, if somebody, you know, claims some horrible medical issue and they can't think straight and they just need something, I'm not sure if any one of us will honestly hold ourselves accountable to the password. But it's the only thing I can come up with, you know, on short notice to say, hey, we've got to have something because these things are coming and they're not coming for just the rich and the famous and the most important people. They're going to come for all of us, right? So I think it's interesting that you mentioned it as, you know, having talked to your mother about some of the same things, because the less tech savvy certainly are going to be less aware of this threat, at least. And I don't know that there's much we can do, but I'm going to ask, I guess the next question really was to talk about like, all right, we've talked about the risk, we've talked about the threat, we talked about the fact this is legal, mostly, when there's some new laws coming out. How do people protect themselves against this? Like individuals, I mean, we'll talk about the company, you, Optery, I actually am really interested. I rarely, and people know, watch or listen to the show, I rarely talk too much about the company that employees or, or the, the guest works with. But this is an interesting off topic. I actually am gonna ask a bit about Optery specifically, but before we get into that, like individuals, you know, you and I, not in tech, our family, our friends, like what do we do to lower the risk here, lower the threat to protect ourselves, to help people protect themselves from, you know, having their information out everywhere?

Yeah, definitely. And everybody has their own kind of like, threat model and risk profile in terms of what they're comfortable with and maybe just the costs involved with maintaining their privacy and security. If you're looking for extreme privacy and security, there's a lot of cost and the cost really is just time. It's just very, it's a lot of work. It's like why is, why we have big cybersecurity teams because it takes a lot of effort, a lot of expertise, but something is better than nothing and you kind of can just start somewhere and get better and better at it. But I think there's just a lot of the typical things that you would look online and do some kind of like basic research, like ways to protect yourself. I think one to start with is just like the, the, the, the 80/20 is just don't recycle passwords, you know, and use a password manager and don't make it so that you're using the same password for, you know, 50 different websites and, you know, can, can find one of those in a breach and then they can log into your LinkedIn and your Facebook and your bank, et cetera. So don't recycle passwords. That's just, you know, it's, it's, it's funny. It's oftentimes very easy. For people to forget that, or just to sort of like a, almost like a layer of sophistication where there's so many people that don't do that. And if they can just do that, they can kind of jump over into a different realm of security. So that's obviously like a, like a, a must. The other one is just MFA and kind of 2FA everywhere, especially with sensitive accounts, anything like banking or financial related. So those are, that, that's another big thing. Two is just, three, restricting the information that you're putting out there. Being really cautious about keeping social media profiles closed and being really cautious about information that you just allow out there on the web, 'cause that is being scraped and crawled and hoovered up by data brokers and nation states, et cetera. So being really cautious about what you allow out there is big. Another one that's kind of not intuitive is being really careful about the apps that you install on your phone. There's some percentage of them that are, you know, that are, have been compromised or that, that are just have bad policies to them. So I, the policy I use is just, is the minimum number of apps that possible, like absolute minimum. Don't just hurt, you know, oh, some new app you hear about, but you're really confident in that app before you install it. So that's pretty, pretty key to just kind of restricting the amount of information of yours that gets out there. And then, you know, just the business that, that I'm in and our company is in is sending opt-out requests and data removal requests to data companies. So, this is something that people can do on their own, or they can use a service like what Optery provides. And so doing it on your own entails kind of like searching for data brokers and scrolling to the bottom of the page and finding the opt-out link and then going and usually entering your name, your email. If you're adding the link of where you found yourself on the site, clicking submit, you'll typically get an email verification, kind of some back and forth. And there's services out there like ours, Optery, which automates that for you. So we have kind of, we refer to as an automated bot that automatically goes out and submits the opt-out requests and handles all of that. We cover around 600 data brokers. So a lot of people use us because they say, hey, like, it's just intractable for me to keep track of 600 data brokers and do all this. We do scans. We have a big search engine. It's like a patented search engine where we go and we search hundreds of data broker websites. And then we have matching algorithms to determine if our customer's there or not. And if our customer is there, we take a screenshot of that and then we actually send that to the customer. We typically find 100, 100 exposed profiles just out on the web listing home address, phone number, you know, family members' names. And we do that monthly. So we have these monthly scanning and removals. So we have every month we go out, we do these crawl, scrape scans for our attack surface management, attack surface intelligence. And then we have this, a bot that submits the opt-out requests on an ongoing basis. And so we, the reports that we provide to customers show initially, you know, 120 exposures and then over time that whittles down to like near zero. The platforms are not perfect. You know, it's a constant game of whack-a-mole and cat and mouse with the data brokers, but they absolutely dramatically reduce the digital footprint of information that's out there by data brokers. And then the last thing I'll just say about an Optery and just the, the space is that these companies are not necessarily interchangeable. So Consumer Reports recently did a study of maybe 7 or 8 of companies in our space, and Optery was the number 1 most effective after the end of the 4-month study. We've won the PCMag Editor's Choice Award the last 3 years in a row as the most outstanding product in the market. And some of the products, if, if you look at the Consumer Reports study, do almost nothing and others do quite a lot. And so anybody that's looking at this stuff, I wouldn't think that the products out there are just sort of like interchangeable. They have dramatically different efficacies.

Interesting. And so a couple of things I want to dig in on. I mean, first of all, you said there were 600-some-odd data brokers out there. Like, I mean, we just, you know, we named off a few as we started talking, right? You know, a handful of 5, 6, 8, 10, something like that. 600 data brokers out there. I mean, I had, it's a number that's just, I mean, it blows my mind. Are they, are these all America-based companies or these just worldwide companies? I'm just stunned there's that many, I guess. Like, is, how is there a big enough market? For 600 companies. That's amazing.

Yeah, it's actually, that's even, that's only what we cover. There's actually more. So the, one of the, the barometers of what's out there is California has something called the California Privacy Protection Agency. And they have a list and it's a data broker registry. And by law, data brokers are required to disclose themselves. And you could probably, a great thing for show notes is that you can, you know, Google it and California data brokers.

I'm pulling it up right now. I've got it right now as, as we're talking, I'm pulling out up. That'll go in the show notes too.

Yeah. I don't know the exact number there off the top of my head right now, but last I checked it was around 500. And so that's 500 data brokers that have gone and disclosed themselves and said, hey, I'm a data broker. I'm selling, buying and selling information on, on California consumers. So that's sort of like one barometer for the number of data brokers that are out there. That said, a lot of data brokers don't disclose themselves. They're required to, but for the CPPA, that has limited resources, like they, they aren't necessarily taking all of those to task. We cover around 600, but there's probably closer to like 1,000. And there's, I've certainly seen some lists out there that like have this big long tail where there's even like maybe a couple thousand. Some of them are really small kind of like operations, others, it kind of depends on how you define it. Some people might classify that dating site that's selling your information as a data broker, but others might not because they have a direct relationship with you. And so in any case, we're constantly increasing the number that we cover. And this is like one of the things that we do. We have a team of people. It's like a— we call it our testing team, and they're constantly testing new data brokers, scouring the web for data brokers. A lot of our customers submit them. So we have something called customer removals, which basically says if you're a customer and you find a data broker that we don't cover, you can submit that to us. We'll make a best effort to remove you from there. And that's how we kind of like do the testing to productize new data brokers. So we start getting the same data broker requested by a few people. We say, okay, let's get that productized and cover it standard. We probably would feel really good once we hit like 1,000. I was like, we're really comprehensive, but even at 600, that's quite, quite a lot.

Yeah, it's amazing. I, I just pulled that database from California, by the way, 550 as of today. That's what their database is showing. You can download a CSV file, a spreadsheet. So yeah, that's a link I'll also provide in show notes. That's really interesting. I think this is, listen, we have a lot of interesting discussion discussions around here about different topics, but this is one that seems to require the most self-service from consumers, frankly. So I, I think it's, it's gonna require more links than I, I normally don't provide a lot of this stuff, frankly, in show notes cuz I'm sort of lazy. But, but in this case, I think we need it. I think there's a lot here and that people are gonna have to prepare themselves. So a couple of things you, you had mentioned, um, that I wanted to dig in on MFA and 2FA. For those who don't know, multifactor authentication, two-factor authentication, you know, everybody should be using that almost everywhere, whether it's a text message, whether it's a, a two-factor authentication app, you know, an email, texts and emails are less secure for those who are aware. I'm sure you know, but it's better than nothing. And for some people, that's all people have now. But you also mentioned password managers. And this year I've been getting a lot of flack, a lot of people saying, well, password managers have been hacked. They're not safe either. Listen, I use a password manager. I still do. It's actually one of the more popular ones that also showed up the news as having been attacked. They're pretty good tools overall, especially if you want to have very complicated passwords. And one thing we've all been told, randomize your passwords, don't use the same one over and over again, which is really valuable, by the way. Somebody spent a lot of time You know, watching cybercriminals operate, it's amazing how often somebody has one password for everything and all they have to do is compromise whatever the weakest system your password is in, your gym membership or, you know, the local Starbucks or whatever it is, right? And now they've got access to your bank account, to your mortgage, to your— it's a terrible idea. So please, you know, separate your passwords and make 'em complicated. But unlike what we've been telling people for a long time, don't necessarily change them. If you have a really complicated secure password and no reason to believe it's been compromised, don't change it. Like it makes things a little bit easier for us. I have randomized terrible passwords. My family hates me if they want to share my Netflix account or whatever. Don't tell Netflix. They all hate me because I have terrible passwords and I have been known to change them occasionally, but I don't change them as often as I used to. So a couple things you mentioned, I think another one you, I don't know if you actually mentioned this one or not. I know we talked about it pre-show, but locking down your credit is a big piece, right? So if somebody does get access to you still being able to get into your credit and use it. Now I will tell you, having done this, it's great. It's also inconvenient. Or can be. I bought a car recently and my credit was locked so they couldn't check my credit score and then I couldn't remember the damn password so I couldn't get it unlocked and I had to deal with the credit agency the next day to get it resolved. But at least it was nice to know that somebody couldn't steal my information, go in and buy a car under my name because they needed the credit report that was locked. So, you know, it's good to know there are some things we can do to protect ourselves. And then of course from the business standpoint, as you mentioned, Optery and some of the things you guys do, and that there are a lot of companies in this space, but it doesn't sound like they're all equal. So. You know, worth doing the investigating on that to find out if this is a, a service that could be useful, whether it's for a business or whether it's for individual. I know you guys have a bunch of them pricing. This is not a sales pitch, so we won't go down that path. Optery.com if you guys wanna know more about these guys. I think Lawrence does really good work with this team and it's hard to do this stuff yourself, so it might be worth, you know, looking into that. So anyway, so with all that said, and I, and I appreciate that, you know, we're getting near the end of the show, so I kind of wanna jump in. The last question I always ask people, you know, the name of the show is Unspoken Security. So, you know, with that in mind, I, I always ask the guest, you know, tell me something you've never told anybody before, something that's been unspoken.

Yeah. One thing that's sort of a bit unspoken in my life is I kind of have like two lives. I have my Optery life. You know, I'm CEO of this company and we have, you know, over 100 people. We've got, you know, hundreds of thousands of people using the product and it's quite an endeavor. It's fun and exciting. I love it. But I have another life where I have 4 kids. And one of the things I kind of try and keep a secret often in my professional life is that I coach a lot of their sports teams. So throughout the spring, I was a head coach of 4 sports teams for my kids. And right now I'm assistant coach. I was a little, maybe a little more than I bit off, a little more than I could chew, assistant coach for 3 teams. And I felt like I've oftentimes been a little bit like shy to share that in professional context. Cause I think people might think like, Wait a minute, you, how do you have time to do that? I remember I had a job interview before I started Optery and I was going through the job interviews and the hiring manager basically was like, we work pretty hard here. Don't think you're going to be coaching any sports teams for your kids around here. You know, we don't do that here. And I think that's great and I have nothing against that, but I was like, that's probably not the right place for me to be. So, It's definitely something that like if I talk to investors or something, I probably wouldn't necessarily like share out of the gate that I spend that much time. But right now I spend 5 days a week on the sports field with my kids. Tuesday, Wednesday, Thursday, and Saturday, Sunday. So, you know, it's maybe something that's like not something I would typically share. So I know, there you go.

Yeah. And that's awesome. So I'm curious, first of all, how old are the kids? What ages are we talking about?

Yeah.

So if you, if you wanna share that, like, I don't wanna give you too much detail about your personal life to the world either, but if you're comfortable sharing how old they are roughly.

Yeah. So one is just about to turn 8, one is just about to turn 6, one is just about to turn 4, and then 11 months.

So, okay. Oh, the 11-month-old, I'm guessing not in a lot of sports yet perhaps, but, well, at least know that so far.

Not yet. Yeah.

And what sports are you coaching?

Softball, baseball, and soccer.

So, wow.

Wow. Yeah.

Okay. That's, I mean, that's incredible. I think most people know me know I coached high school football for a while. Yeah. For a handful of years while working, I was in the military and then I was in defense contracting before I was in the private sector. And it's an incredible undertaking. It's a ton of work to do that. I would love to, I thought about going back a few years back. I had some interviews, actually was offered an opportunity and then I had to have a gut check. In my case, I said, I don't think I can do this because I don't think I can give the kids enough time because my calendar wasn't gonna allow it., you know, with work. So I'm impressed that you're able to make the time to do that. You know, it's, I think it's awesome though. You know, it's unfortunate. I think that we have a situation where we have people who, who want to be able to do this. You know, they want to have a career and a life, but they also want to be with their family and take care of things and, and give back. I mean, what you're doing is good for your kids and I'm sure for a lot of other kids. You know, it's a shame that it's something that has to go unspoken. Good news for you, there's like 12 people that listen to this show, so I don't think it's gonna mess anything up with your investors. You're probably still safe. But I, you know, personally, I think were it me, it's not, but I don't have that kind of money. But if were it me, I'd consider it a positive. I mean, here's somebody who wants to give back and be involved, right? It can't all be work. If we're all working all the time, we're probably pretty miserable. I know some of the best ideas I got were when I was doing something else. I was thinking about football and then something came up for work, or I was thinking about work and then something came up that I had to write down because it was related to football or leadership or the team or something. So I think it probably feeds— I don't want to speak for Al Ask, I guess, but whether it feeds your mind in a different way or feeds your soul, for lack of a better word, I guess, feeds you in a different way. It gives you more energy, and do you think this actually benefits you and makes you a better leader, you know, for the company and for the people?

Yeah, I definitely do. So one, I think it's definitely, it's amazing that you were coaching in high school football. Definitely a totally different commitment level coaching high school football at this age for my kids. At this age, my kids, it's basically like practice Tuesday night and game on Saturday, you know, that's like, you know, pretty much it. So it's definitely not like the kind of commitment that you'd have at like the high school level, for example. I don't think I'd be able to do. The number as they get older. But for now it's like pretty manageable. But absolutely, to your point, I think it definitely can have its benefits. I know that in the spring when soccer and softball season ended and it was the summer, I felt like a little bit rudderless in a way. Whereas before I had like every day it was like work, like soccer field or baseball field. And then this, it ended and it was like kind of summer break. And I was telling my wife, I'm like, I feel like I, I'm like, uh, lost a little bit of direction here. So, and sports picked back up in the fall. But I definitely think there's something, at least for me, I grew up on a sports field. I just was playing sports my whole life. I think so for most of my life, I just sort of was like hitting the books for school and then like out on a sports field running around and where I, as my kids have gotten a little bit older, just to be back out on the sports field running around, it feels like my soul is like complete or something. So I think it's like there's a lot of things that, that you can do that are good for you beyond just like working, meditation, exercise, spending time with family, watching a movie, reading a book, whatever it is. And for me, being out on a sports field, kind of running around is like, you know, is, is like really enriching and I think gives me a lot of energy. So for me, it's been a big positive. And then on top of that, it's like, I always think when I'm doing it that I didn't really realize that when I do it now, I'm always like, oh yeah, like there were people out there that were like leaving work early or like waking up early on a Saturday morning to make sure that I had the experience to be out on the field, like with the chalk rolled and like the, you know, you know, calling the plays, like people made that possible for me. And so it was like really cool to be able to make that possible for other, you know, other kids. So that's like pretty rewarding. And then I definitely think there's a lot of leadership skills that you can gain from coaching kids, you know, like there's a lot of the similar things of like maybe, you know, dealing with a team at work or isn't dealing with the team in, on a field, like a lot of similarities. So it's, it's definitely a good thing, I think.

Yeah, you definitely learn patience. Yeah. Now I'll be honest, I, again, I coached high school. I wouldn't be necessarily the right person to coach smaller children. I think there's a right person in a right place at a right time, right? You have to have the right demeanor and the right temperament. I probably don't. I don't know that I'm gentle or patient enough, frankly, for smaller children. I would be the coach kids shouldn't have because they want to grow up happy and want to like the sport and I'll probably ruin it. That's just not how I'm built, unfortunately. Even at high school, I could be a little intense, but I did learn patience, right? And like you said, teamwork and building, but also listening. It's different, right? Kids aren't us. They speak differently, they communicate differently, and learning different communication styles and trying to find new ways to bridge gaps in communication and the art of persuasion takes on a whole new thought process when you're dealing with kids, especially kids that aren't your kids, because ultimately they don't have to listen to you necessarily. And so, yeah, for me, I found it was pretty rewarding and giving back. I think it's a good point you mentioned it. I played sports growing up and also didn't realize, as a kid, you don't know. As an adult, you realize just how hard it is for these adults who are going to have their full lives and their careers and their own families, and then they're going to take time away to go do this other thing that almost certainly isn't paid or is paid incredibly low, and they do it because they want to give back, right? So I think, you know, you get a new— I got a newfound respect, I think, for all the people that helped me along the way to become the super mediocre athlete that I did become as a result of all their hard work and efforts. I'm sure everybody's very proud of the time they put into making me so bad at almost everything on sports, but I appreciate it. So yeah, I think it's great, man. I think the fact you're spending that time with the family and with other kids also anything that gets us out of the house. I spend most of my time under artificial lights at this desk. Gets you out in the sunshine and the weather, and I think it's awesome. It's unfortunate. I think it's less spoken, but I'm glad it's not unspoken anymore. I hope people see it as a positive because I do. I think it makes you a more well-rounded person and somebody I'd be more likely to want to do business with at least. So hopefully the 12 people that do hear this will say, well, Lawrence is great. Now I really want to check out Optery because he's also a good guy. So So maybe that'll be beneficial. All right, listen, so we're wrapping up here. First of all, I want to thank you for taking the time to come on to talk about data brokers. I think it's a topic that doesn't get talked about enough. As I said at the opening, I think it's something that impacts pretty much everybody, frankly, whether we like it or not, our data's out there. So understanding that it's legal, understanding the processes, understanding the threats, the risks, you know, what's coming next and what we can do about it, whether it's ourselves or with companies like, like Optery, you know, I really appreciate you taking the time to come and talk about it. Before I do wrap up, is there any Anything you wanna add? Any last thoughts? Anything we missed? Anything I skipped? Because sometimes I run fast and I miss questions we were supposed to talk about. Is there anything you wanna add as any last thoughts before we wrap up?

No, I think it's just, no, I don't have anything to add. Just to thank you for helping kind of bring awareness to just not only this topic, but the host of topics that you cover. And I know it also like coaching, it takes time. It's a, you know, and ultimately I think you're helping people. I've listened to, you know, several episodes and I always learn something. So, you know, where you're, you know, not coaching high school baseball, but you're kind of like helping disseminate information that's helpful to people. And I appreciate the opportunity and appreciate what you do. So I'm really excited for the opportunity and, you know, thank you for the time together.

Yeah. Well, thanks. I appreciate it. I'm going to say now I have 13 people that listen because I know you do. So, you know, so it's going, growing up one at a time. It's fantastic. Hopefully more will join the force. All right. So with that, listen, I am going to wrap it up. Thank you again for being on, Lawrence, for talking about data brokers and optery. Thanks everybody for listening and watching, however it is you consume this today. I appreciate it. If you like the show, please do, you know, like it and recommend it and bookmark it and subscribe and all those things. If you don't like the show, please don't tell anybody that, but feel free to tell me and I'll see if I can make it better. But again, until the next time, thank you very much for listening and watching. This has been another episode of Unspoken Security. That's a wrap for this episode of Unspoken Security.

Security.

If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

Legends are made.