Episode 140: Cybersecurity Girl Caitlin Sarian Tries to Delete Herself Online
19 Mar 2024 · 33 min
This is a podcast interview (Episode 140) featuring Caitlin Sarian ("Cybersecurity Girl"), recorded March 19, 2024. Hosts Adam Levin, Beau Friedlander, and Travis Taylor discuss Caitlin's social media work teaching practical cybersecurity and privacy, covering topics such as open-source intelligence, data brokers, deletion services (DeleteMe), breach-checking (Have I Been Pwned), GDPR/CCPA/federal privacy law tensions, consumer best practices (passwords, MFA, cautious data sharing), and concerns about biometrics and data resale. The episode mixes practical advice, anecdotes (e.g., family DNA tests, car-data lawsuit), and policy discussion about the difficulty of exercising deletion/access rights across fragmented data ecosystems.
Chapters
This episode is brought to you by cars.com on cars.com you can shop over 2 million cars. That means over 2 million new car possibilities. Like making space for your growing family, becoming the type of person who takes spontaneous weekend camping trips, or upgrading your commute wherever life takes you next. Or whoever you're looking to be. There's a car for that on cars.com visit cars.com to discover your next possibility.
This episode is brought to you by State Farm. Listening to this podcast. Smart move. Being financially savvy. Smart move. Another smart move. Having State Farm help you create a competitive price when you choose to bundle home and auto bundling. Just another way to save with a personal price plan, like a good neighbor, State Farm is there. Prices are based on rating plans that vary by state. Coverage options are selected by the customer. Availability, amount of discounts, and savings and eligibility vary by state.
Hey, Bo, you remember when Travis did his dissertation on the dangers of QR codes?
Yeah, it was total tinfoil hat territory.
I bet you didn't know that Caitlyn Sarian, AKA Cybersecurity Girl, did a whole thing this week on Quishing.
I have no idea who that is.
You don't?
No.
She has a huge following online. She's kind of a big deal.
Define huge.
More than us.
And with that, welcome to what the Hack? A True Cybercrime podcast. I'm Adam Levin.
I'm Beau Friedlander.
And I'm Travis Taylor.
Caitlin Sarian, welcome to our show. So where are you coming to us from?
I'm sitting in Miami, Florida right now.
Oh, my gosh. Is Miami still above the sea level that you can go outside?
I mean, barely. We all have. There's a huge storm right now, so I'm pretty sure we're about to be underwater and probably at the end of the podcast, so.
Oh, well, if that's the case, we'll do our best to. If Amazon's still working, we'll have them send you a raft. Caitlin, your Persona online is Cybersecurity Girl, and you have a robust following on Instagram and TikTok. How did you get into it and how long ago? I'm curious.
Yeah, so it's a little over two years now, which is crazy to me, but I was like, what can I contribute to this world that will actually be helpful? And then I started realizing that I always get asked questions about cybersecurity. And so there was three pillars. One was to just, like, demystify what cybersecurity is. The second was to get more people into a career in cybersecurity. And the third was to get more women, specifically in STEM field.
So what topics work best?
So, honestly, the ones that go the most viral are the ones for the general public on how to be safe online. And the way that I tell that story is explain kind of the what happens if they don't do that. If I say, hey, someone's in your baby monitor, as if you're not fixing this setup, then it's more alarming and people realize, oh, wait, this does relate to me. Cybersecurity relates to everyone. Privacy relates to everyone. But we've never told the story that way.
Can your followers follow you when it gets complex?
To be honest, I can't follow myself when it gets complex. So that's why I have to break it down in very, very simple terms.
I mean, okay, speaking of complex issues, I think open source intelligence was one of those things for me. I understood that the information we share online was out there, but I didn't fully understand the implications until I was on this Telegram channel and our very first episode of what the hack was with a close friend of mine named Roy.
It was right before the inauguration, I think, when Parler got kicked off of their own. Their own app was shut down, and it was in the news that everyone from Parler was migrating to Telegram.
Roy and I were like, we're going to get QAnon people. We're going to get them to expose themselves.
And we were kind of pretending like we were Trump supporters.
And Roy immediately gets hacked by one of them. And I find myself in a subgroup with this dude who goes, you seem really intelligent. Do you want to do open source intelligence with us or we're taking down the Democrats? He explained it to me, and I was like, so basically Googling.
So some really cool technical people like to say that Google Dorking and we're, you know, searching and scouring the Internet. Google Dorking is another way of just basically saying googling. But open source intelligence is literally getting intelligence from sources that are open to the public. So a lot of times it really is just like glorified Googling, honestly. But there are specific websites that you can go to for certain things. Like data broker websites can get a lot of information. Like the white pages is huge for a data broker, but there's hundreds and thousands of data brokers that you can go on and get. First name, last name, your parents, phone numbers, your parents names, your parents addresses, any address ever affiliated to you. I don't find myself particularly smart, and I can do it. So I feel like anyone could do it if I could do it.
I know it's a term we all use, but when we talk about open source intelligence, aren't we just talking about privacy or even cybersecurity?
I think understanding privacy is like the gateway drug to understanding cybersecurity and why it's so important to be completely honest. Because if you start realizing how important you want your privacy to be, you'll start realizing how important you want your employer's privacy to be, you want everyone else's privacy to be. And then that's also cybersecurity in general. Like, it's making companies aren't getting hacked. It's taking the precautionary measures. And honestly, those precautionary measures are the same whether you're protecting yourself or you're protecting your company. So I think I really love privacy. I think that's the one way that we can get people excited about cybersecurity as a whole. I mean, because if you start talking down the road of all cybersecurity aspects, honestly, the reason why people start caring more about cybersecurity is when it pertains to them, and that's really their data privacy.
How did you get into this area?
I got into cybersecurity about 10 years ago on a whim. I did aerospace engineering in university, and they asked if I was interested in cyber. And I was like, that sounds great. And then I got my toe in cyber and pretty much jumped in full throttle at that point. And I was like, you know, I want to learn something else. And I just somehow. Data privacy and data protection. I started data protection specifically. So really understanding companies, crown tools, what's most important, how do you protect that? And then I love the privacy aspect because that was like understanding my crown jewels. What am I trying to protect for me personally and how am I protecting.
Myself when it comes to privacy? I think a lot of the things that people know about are how to be proactive, like not giving out your information or lying about your information and so on. How important is it to be reactive with your privacy?
That's a great question, Travis. Everyone, when the Internet started, you know, coming about, we wanted to sign up for everything. We wanted to create every account, we wanted to download every app, we wanted to give everyone our email so we could get the 20% off. And as much as it is for us to start realizing maybe we shouldn't be giving our email to everyone or creating accounts for everyone, but we also need to realize that we need to Be, like you said, reactive, which is. Okay. What do people have on me right now and how can I fix that? So I use a company called Delete Me for. For data Brokers, because data brokers have all of our information. Like, even the government sells our information to data brokers, which I find absolutely hilarious. And so it's not just like, oh, I signed up for Amazon and now people have my data. Like, anything that you do online, your digital footprint grows, and that goes to the data brokers, because it's literally anytime you go online, your digital footprint is growing. So they scan the Internet every two months and actively delete, like, information about me, which is a lifesaver. But the other thing that you need to think about, and a lot of people don't, is, like, start going through your emails and being like, instead of just pressing unsubscribe, like, go to that website and ask them to delete your data.
So, Caitlin, we had Rob Chevelle, who's, as you know, the CEO of Delete Me on a previous episode, and. And we loved it. Can you explain the difference between a site like have I been Pwned And a service like Delete Me?
So Delete Me just helps delete your personal information off of those data brokers. And have I been Pwned Is literally, it tells you what data breaches you are involved in. So they're completely separate. Both incredible resources to have. I honestly, like, instead of, like, Googling myself, I, like, looked at my. Look at my have I been pwned, like, many times throughout the month just to see if anything else happened.
Okay, so given the fact that our data is being collected, and it's being collected from more sources than we could ever hope to keep track of, what is the best way to manage our digital lives?
I'm sure some of our listeners are wondering if they should just go full Luddite, get offline completely.
The problem with that is if you want to have privacy nowadays, you kind of have to be super proactive about it, because every time it's like weeding a garden, right?
So if you continue to create accounts, if you continue to buy stuff, if you continue to do anything under your email or a username that's linked to you, there's so much other information out there. I personally use a few platforms that allow me to spin up real working emails and phone numbers. So if I ever have to sign up for something, I'm not ever putting it towards mine or, you know, there's other ways to just kind of detach yourself. From your digital footprint and your online identity.
So Travis, what do you do?
I mean, I use privacy friendly browsers like Firefox. I limit the data I give out. I tend to connect to the Internet through a VPN and when possible I go to brick and mortar stores.
I've been thinking a lot about it in connection this year with the elections. It really worries me that this is a serious attack vector on a number of levels.
Yeah, there's the larger worry about disinformation and foreign meddling and there are plenty of smaller worries. I mean issues.
I mean literally micro emails and tons of texts and a lot of communication. So with political emails, that's the first thing that comes to mind for me. No matter what I do, my email address is getting sold and resold and sold. And no matter what anybody does, that information's already in a marketplace.
Yeah, because I have heard now from every human being in every party running for every office, and it happens day after day after day.
I think for like from an email and like a personal information perspective, legally, if you request for them to delete your data, they have to delete your data. Now obviously it's the more that you're online, the more it gets sold to them. I will say, I mean, it is crazy that as a country we allow this to happen because it doesn't really happen in any other country.
Yeah, I think like 15% of the countries in the world, including US, have zero privacy legislation and something like 70% of the countries in the world do.
Huh, that's freaky.
What do you do in a situation where you may end up getting your data deleted from one or two brokers, but there are other organizations they've already sold the data to who are then reselling the data to someone else. So this is like whack a mole.
A lot of people don't really actually care about that because they actually want the catered ads. So it's a very interesting situation in a weird web that we weave because. And I think that's what makes privacy so cool. Because people think privacy is dead right now. But if anything, I think privacy is the most enhanced and it's needed the most right now than it ever will be. Because privacy is the ability to say, okay, I want these people to have my data and these people to not have my data. And at this point it's kind of difficult. Like you said, like one person selling it to the other. Even if you've already requested for them to delete it, it's really difficult to have that Separation but privacy, hopefully with new privacy laws and regulations that'll come up, it'll be a lot easier or better for consumers.
Well, that's the question I have for you, because I was in Washington last week, we were talking a little bit about privacy. And the whole issue is that there are too many organizations pushing elected officials, through lobbyists not to have that kind of privacy.
Yep. So privacy like GDPR or CCPA really empowers us as consumers to have access and control over our data. And I obviously was a consultant and worked at a massive law firm and a massive consulting company as well, who helped companies, large companies, try to abide by these laws. And it's very, very difficult. It takes a lot of manpower, a lot of money to actually allow this to happen. Because when the Internet first came to be, data was king. So you wanted to collect all the data as much as possible. And now you are still trying to collect that data, but you're trying to only collect it for necessary purposes. You're really trying to reel back what you've already collected. It's a very weird time right now for privacy. But I think for me personally as a consumer, I want to be like, yes, we need federal privacy of law. And I think companies should be getting on board with this because it's harder for companies to abide by random state laws versus one blanket federal law. But yeah, like I said, it's very. There's a lot. It seems really easy to be like, oh, just don't collect as much data. No, there's a billion different ways that you can cut it. I mean, it's not even just collecting data. And then there also needs to be documented evidence that you allowed the consumer to do that and that you've deleted it correctly.
So let's talk a little bit about compliance. Right. So from your perspective, why is it so hard?
So when you're collecting information, you have to think about all the different teams that are collecting the information and the purposes of collecting information. Right. There's internal information for your employees, health benefits, payroll, all of that stuff. This all counts as consumer stuff. And then there's the actual end to end consumer, which is marketing, sales, what they've purchased everything. And it goes to so many different teams. From there. You have to figure out, like, if, if I, Caitlin, were requesting my data, let's just say from Nike, there's not like a central source for many of these large companies. There's just not. It's in so many different teams and it's being used in so many different ways. And so you have to have a way of validating that I, Caitlin, am actually who I say am through an email, which is extremely hard. You don't have to do a phone call or something else. You're collecting more data on people, right? Because you're asking for more data to confirm that identity. Once you confirm the identity, then you have to collect and confirm that you're collecting every single piece of data on me, which, let's be real, in Nike or any large business, it's almost impossible. And then on top of that, you also have the right to be like, hey, that that information is incorrect. So then you have to have a way of confirming that what I say is correct and what you had is incorrect, which is a whole nother process. Or let's say you have to delete my data or I'm requesting my data. So then you have to have a way of sending me securely all the data that you have on me, which is a feat in itself. And then also if I request delete it, you have to have a way to officially wipe all of the data off, including the data that's stored on a backup service. So it's. There is so many steps that you have to take, and that's just from consumer or employee side. And the issue is that there's no central source of data. Really, that's like the main issue.
You've told me that I have the right to say to Nike, once I prove to Nike that I'm really me, that I want this stuff deleted and they have to delete it. Where does that right come from? Is that because of the California Consumer Protection Act? Is that because of the GDPR that every company says, well, if I'm going to function in this world, I have to comply with that.
A lot of large companies use CPA and GDPR as a baseline. So they're going to go as if they're working from them. If you're in a town in the middle of Texas, they don't have the same rights or rules. So you as a consumer don't have the right. And if you live in Texas too, you don't usually have the right to ask to delete your data unless it's a large company that uses CCPA as a baseline or GDPR as a baseline. So it makes it very difficult. Like I said, there needs to be a federal law that allows this to happen.
While a federal privacy law sounds great, I do have to wonder if laws like the CCPA actually do help pressure other states into providing more Privacy legislation. Yeah. Just for instance, if I'm on a website and it says on the bottom, do not sell my information, I click on that and it says, do you live in California? And you have to say, no. Then they say, sorry, we're selling your information. When I see that, I think I actually want to write my congressperson and just say like, hey, can we get something similar up here?
I think CPA did an amazing job in leading the way for other states. The issue comes from a company perspective, when multiple states are starting to add privacy regulation and privacy laws and they're a little bit different or they're a little bit skewed, or one is a little bit more stringent in one section. And so it's going to be, from a company perspective, it's not going to be easy, and it's already not easy. So that's why I think the federal is the most important. At least it have have the baseline, hopefully maybe it make it the most strict. That way we don't have to worry about state by state. Companies won't have to worry about state by state, but they can really just follow a federal regulation.
Do you think there's a danger, speaking of having a strict federal law, that there's a danger if we end up passing a federal law, that it'll end up watering down privacy protections in the states that have already established pretty strong ones.
I'm intrigued why you asked that.
We have the California law, which is great, and the Illinois law in terms of biometrics, which is great. And then if you have a federal privacy law coming along and saying we're going to water that down in both cases, what that might mean is you have a rollback of privacy in the states that were already sort of at the forefront 100%.
Travis. I mean, if Trump, for instance, becomes president again, he's. I'm moving to France, but he's probably going to try and roll out a federal law for guns. And what that's going to do is it's going to destroy the really robust gun laws in states like my state, Connecticut.
That's why you have pushback in Congress to any federal law, pretty much anything. So that's why things just don't get done. I mean, if, if my state law is robust and you're proposing something that's significantly weaker than my law, I'm going to fight like hell to make sure that your law never gets passed.
Well, I thought they just fight just because they hate each other.
Well, they do, too, but that.
We'Ve got Gifting all wrapped up at Sephora. Gift more and spend less with our value sets packed with the best makeup, skincare, fragrances and hair care they'll love. This year's showstopper gift sets are bursting with beauty products from rare beauty, Summer Fridays, Glossier Amica, and so much more. Shop holiday gifts@sephora.com and give something beautiful.
Hi, I'm here to pick up my son, Milo. There's no Milo here who picked up my son from school.
Streaming only on Pico.
I'm going to need the name of.
Everyone that could have a connection.
You don't understand.
It was just the five of us.
So this was all planned.
What are you going to do? I will do whatever it takes to.
Get my son back.
I honestly didn't see this coming.
These nice people killing each other. All her fault. A new series. Streaming now only on Peacock.
Caitlin. We've mostly been talking about one type of information that companies collect, but there's a whole other industry that has historically kept data on us, and that's credit cards. Can a company like Deleteme or any other human force on earth get the credit card companies to delete? Can I call up Citibank and say, like, hey, you know, I bought sneakers, guitar strings, a pencil, and a tractor. But I don't want anyone to know that. Can. Can I make you not share that information with anyone? Credit card company.
This is where the privacy law gets a little wonky because companies can save their data for legal purposes. So I am assuming that most of the reason your credit card company is going to say, well, we need to know that you bought this stuff just in case, I don't know, in case.
You'Re the Unabomber and we want to come getcha.
Yeah, pretty sure he was more of a cash kind of guy.
Yeah, exactly. Who knows? But there's kind of ways to go around it. And so a lot of companies were taking a risk based approach on what data they were allowed to keep before deleting. And I think the credit card companies have taken a. A risk based approach to not actually let you delete anything.
Obviously, this is not as black and white as any of us would like it to be. I mean, we started today by talking about how complex a lot of this can get, even for us. So I'm curious, what advice would you share with our listeners? Where do you start?
So the first thing is passwords create really strong, unique passwords. And if you're not creating different passwords for every account, at least group them. So, like, you have different passwords for banking accounts because those are really important. You don't want to have the same ones. Or social media accounts. If you, if social media is a big thing to you and you don't want to lose them, turn on different passwords for that and then turn on multi factor authentication. That means just two ways of logging in, whether that's getting a second email or getting a text message. I would definitely turn on multi factor Authentication. And then the third is just be mindful of where and who you're sharing your data with. And that means if you're getting a phishing email, that gives you some sense of urgency that you have to act now. Like, be mindful. Like, before you give out your information. I always say, take a deep breath. Is this a company I want to give my information out to? Do I need to have this account? The first question, the second question is, if I absolutely need this account, will I be able to delete it after? Third question is, why are these people asking for my information? And fourth question is, is this urgent? If I'm feeling like a sense of urgency, something's probably up. And then the fifth is like, what's my gut saying? So anytime you type in your email, you type in a password, you type in any of your personal details, take a step back, see if it's actually needed.
And sometimes it's not obvious or we're just used to giving away some of our information.
There's also new apps now that allow you to sell your data. Like you give permission for people to use it and you get like money or some monetary value or oh no.
That'S a coupon service. That's like, with the gas. I had that app for a half a second and it was such a ripoff.
My mom has that app too and I'm like, please get rid of it.
I had that for work, you know, I had it because I was like, let's see how it works and see what it does. Because I'm very post privacy in my own life. I have everything locked down. That's how I deal with it. I have all my accounts frozen. I operate as though I've been breached all the time. It's easier that way. I have two safes in the house.
We didn't even know your real name.
No, it's true.
Most people don't what you think, Alphonse.
But seriously, why do I have to give my email address when I'm buying something in person?
By the same token, if they were to hand me a swab and Ask me to just rub it in the inside of my mouth and give it back to them. I would also say, no. This is your information, whether it's your DNA, which seems very personal, or your email address, which is very personal, which.
Which brings us to a DNA company that had a breach not too long ago.
Yeah. Okay, let's hear you, cybersecurity girl. Tell us, what do you think of 23andMe?
Oh, no. I mean, when they first came out, I immediately told my family, do not do this at all. Like, just. No, just. We don't need it. We know that. We're Armenian. It's fine. What is the purpose of getting this done? Later on, when 23andMe started saying that we're going to start matching and seeing what, like, diseases could be in your family, my parents were a little intrigued, but I was just like, nothing good is going to come of this.
My cousin uses 23andMe, and all of a sudden my data, which I had no interest in putting out into the world, is sort of out in the.
Well, I did have certain extended members of my family that found out that there were other members of the family that they never knew existed.
Sometimes ignorance is bliss, don't you think?
Yes, absolutely. It got somebody in a whole lot of trouble.
That is way too much information.
Adam, you didn't say who had a child out of wedlock.
Exactly.
And that's the thing, because all these websites and apps talk to each other or they share and receive information from these data brokers. So suddenly your privacy is a whole lot more difficult to protect.
I've gotten annoyed with relatives of mine getting the test done where I'm just sort of like, you are roping me into this.
And, Adam, I remember you found out that you came from a long lost group of whale fishermen from Iceland. Is that right?
Actually, they were from Greenland. But, no, I've never done. I've never done 20. And you never will, because I'm terrified to do it.
So, I mean. But that's the thing. You're in the business of making people more aware of their information, who might want it and how they can protect it.
Exactly.
What do I need to know, Caitlin, about the stuff you teach your followers? So what are the best practices, the easiest way for me to understand that my data matters and it can be protected?
Basically, I'll just say, anytime you go online, you're creating a digital footprint, and the digital footprint, your digital footprint continues to get larger and larger as you go to different websites and you do download different apps. Anything that you click and it's, it's a money game. The people on the other end are making money every time you click on anything because you're there, you're collecting data and they're going to be selling your data. So just be mindful of where and where you're giving your data and what you're clicking on and who you're giving your data to. If it's not someone that you want to give data to, maybe don't create an account for that website or don't go on that website. But just again, be very mindful of anytime you are logging into the Internet, anytime you go on the Internet, you are adding, having a bigger and bigger digital footprint and your information is going more places. So just be extremely mindful of who and where you're putting and giving your data to.
Can you even know at the end of the day where your data is being given?
I mean, if you don't log onto the Internet, you know it's not going anywhere, right?
Well, we always like to say if you're living under a bottle cap at the bottom of Loon Lake, but short of that, you're out there, I would.
Like us to know where it's going. And this is goes back to the privacy laws again, where we need more regulations on what companies are doing with your data and we need to have transparency from a consumer aspect on what companies have on us, because once we have that, then it's a lot easier to answer that question, right? Hopefully.
So you've convinced us and all your followers to take privacy seriously. But now what? I mean, I know we've mentioned have I been pwned and delete me. Have I been pwned as free? But what about Deleteme or other services that remove your data on your behalf? Are they free?
It is not free.
So it's a subscription model.
Have I Been Pwned isn't actively going out and deleting your data. They're literally just scraping information off the dark web and telling you where your data was breached. Delete Me is actively going out personally and deleting your data off of data brokers.
We had Kashmir Hill on the show talking about your face belongs to us. Her book. We live in a world where facial recognition is becoming more and more part of our daily lives. How do we deal with that?
Biometrics and stuff? Is that something that you try to opt out of or.
So I've picked my poison. My face is all over the Internet, unfortunately, so I can't really do anything about it. At this point, I would actively avoid putting my kids online, and I would probably try to have as small of a footprint as possible with, like, pictures and stuff. The only reason why I'm on social media is to educate the public.
Caitlin, I can't thank you enough for spending time with us, telling us about what you do and just sharing your life. And we appreciate that.
Yeah, thanks so much. I really appreciate coming on here. I really appreciate what you're doing, and I think the world needs to hear your podcast.
Well, thank you for that. But if someone wants to learn more about you, what you do, where do they find you?
You can find me on social media, on Instagram, @cybersecuritygirl, or on TikTok ibersecuritygirl.
There's a rhythm in every step. Progress isn't just measured in time. It's spelled in the push to keep going. The TAG Heuer Connected Caliber E5 smartwatch brings Swiss luxury and modern craftsmanship into a design built to keep you moving, connected, and in tune with yourself. Because every day is another chance to prove you're designed to win. Visit taghoyer.com to learn more about the new Connected Caliber e5.
The who's down in who Newville were making their list, but some didn't know Walmart has the best brands for their gifts. What about toys? Do they have brands kids have been wanting all year?
Yep.
Barbie, Tonys, and Lego Gifts that will make them all cheer.
Do you mean they have all the brands I adore?
They have Nintendo, Nespresso, Apple, and more.
What about so the who answered questions.
From friends till they were blue? Each one listened and shouted from Walmart? Who knew? Shop gifts from top brands for everyone on your list in the Walmart app.
And now it's time for the Tinfoil.
Swan, our paranoid takeaway to keep you safe. All on and offline.
Did you read in the New York Times about this guy who's suing over the data his car was collecting on him?
I did. It was written by someone who's been a guest on our show, Kazmir Hill. She's the author of youf Face Belongs to Us.
I glanced at it. What's the short version? Travis?
I can do the short version.
But your name isn't Travis.
So a man in Florida is suing General Motors and LexisNexis for collecting and providing information that was used by his insurance provider to double the cost of his coverage?
Well, I mean, this shouldn't really come as a surprise. We've talked about the non existent Privacy policies that come with most new cars. We even dedicated the better part of an episode to it with guest Jen Kaltrider of Mozilla, the person behind that organization's Privacy Not Included program.
That was a good episode. The whole thing.
What are you talking about?
You said the better part.
Okay, guys.
Jen Kaltreiter is an expert on privacy policies and on data sharing practices of automobile manufacturers. She discovered they collect a shocking amount of data, and they can share it.
Yeah, well, I guess somebody's going to be winning a Peabody. Our episode created a lawsuit.
We weren't mentioned in the coverage, but it was pretty interesting. I mean, the guy in the story installed the gm my Cadillac app, and it enrolled him by default in a.
Program through OnStar which recorded hard accelerations, hard braking. I'm telling you, we're going to get a Peabody.
From your lips to God's ears. The data was sold to LexisNexis and then again to another data broker and finally to his insurance company.
It's the circle of data.
So what's the takeaway? Buy a classic car.
There was a clause in OnStar's privacy statement saying they could share the data with third parties.
Travis.
Eh, I mean, a spokesperson for GM said it was possible to unenroll, but in this guy's case, and I'm assuming a whole lot of other people, it's really hard to unenroll from something that you didn't know you were enrolled in in the first place.
Right.
And at least in this case, the damage was already done. His insurance rate doubled. Opting out of this service isn't going to lower his rates.
And as we always say, all apps are not created equal. Cadillac predates smartphone apps, and like most apps, they're designed to collect sellable data, or at least usable data.
Yeah, I mean, we've talked a lot about privacy legislation, and that, to date, really just hasn't worked. At least, as we discussed earlier today, maybe this kind of lawsuit will actually finally help change the behavior of car manufacturers.
And that's our tin for oswat.
What?
The hack with Adam Levin is a production of Loudtree Media. You can find us online at Adamlevin.com and on Instagram, Twitter and Facebook. Adamklevin.
Loud Tree.
Black Friday savings are here at the Home Depot, which means it's time to add new cordless power to your collection. Right now, when you buy a select battery kit from one of our top brands like Ryobi or Milwaukee, you'll get a select tool from that same brand for free. Click into one of our best deals of the season. And stock up on tools for all your upcoming projects. Get Black Friday savings happening now at the Home Depot. Limit one per transaction exclusion supply full eligible tool list in store and online.
When you walk into a Burlington, you're walking into amazing prices and great gifts. That's main character energy. Because at Burlington, the holiday savings aren't the only things turning heads. Discover quality finds and perfect presents for everyone on your list, even those who are hard to shop for toys and jewelry to new beauty brands and styles. These gifts go seamlessly from our stores to under your tree. Seriously, with these savings, why shop anywhere else?
More from Caitlin
Week in Review: APTs using Gemini, ransomware payments decrease, abandoned AWS risk
Episode 27 - Protect Yourself Online: Mobile Carrier Breach, Password Tips, and QR Code Scams
190. More Than Money: Decoding online safety from personal data to shopping with former TikTok cybersecurity lead, Caitlin Sarian aka Cybersecurity Girl