Robert Siciliano, an identity-theft analyst, explains how tracking firms combine just 33 bits of data like age, zip code, and browsing history to build profiles that predict income and buying habits. Advertisers use these for targeting, but criminals exploit the same profiles for identity theft. Private browsing won't help if you're sharing personal details on social media.
Chapters
The news begins anew on Studio B. And in box number 3, online spying. Get this, just by visiting a website, you can give companies enough information for them to figure out your salary, whether you have kids, what car you drive. How it works, where your personal information is ending up, and why you should care. That's all ahead unless breaking news changes everything on Studio B. 19 minutes past the hour. There is no privacy on the internet, but you may be surprised at how some seemingly harmless bits of information can give companies more data, really, than you can probably imagine. A new investigation by the Wall Street Journal, our corporate cousins under the corporate umbrella, examining the business of internet spying. Here's how it works. When you land on a site that uses one of these companies, the software logs the information passed between your computer and the site, and it notes where your computer is physically located. In some cases, it also records the other websites you visited. Then, in a fraction of a second, the companies can analyze all that information and assign you to a demographic, then determine whether you'd be a valuable customer, even what your salary could be in the future. And that's just the start of it. With us now is Robert Siciliano. He's, uh, the identity theft analyst for McAfee.com. A website, a web security site, I'm sure you've heard of it, the founder of IDTheftSecurity.com. Good to see you. Thank you.
Nice to see you.
What are they doing with this information? Can they tie it to me, me as an individual? Do they know who I am and what I'm doing, or is it more demographically specific, not specific to individuals?
Well, they say they're not recording your name, but essentially you and I have been boiled down to 33 bits of data. And that basically means that they are able to compile age and address and make of car and zip code and all these other bits that they seek out on the internet based on web history, based on tracking software on different websites that you visited, care of your own browser.
And the idea would be they can market to you things that they think your profile suggests you're gonna want.
You get to a certain website and based on your browser and who you may be, they begin to show you advertisements on who you are based on statistical analysis from history, based on the tracking from websites you've previously visited.
How they gonna figure out how much money I might be able to make, what kind of car I drive, how many kids I have, whatever?
They're able to resource and access multiple databases instantly, uh, information they probably already have housed. And then from there, you know, through statistical analysis, they boil down zip code and what the average income might be, uh, around— for the people around you, uh, the make and car that you may drive and so forth, websites you visited. And then from there, they can kind of boil it down pretty quickly based on, you know, gender. Once they start cutting out all these different, uh, eliminating certain bits of data and combining bits of data, —then they have a good profile of who you are.
What's the overriding concern there? What should have people— I don't know, why do I care?
Well, for me, my biggest concern as a security professional is if the good guys can do this, then the bad guys can probably do it better.
And the bad guys could target you in some way? They could target you.
They could compromise your identity. You know, that's what— that privacy, you know, they find out more and more about you. And often, unfortunately, it's the consumer that's providing a lot of this information.
Sure. You know, if you're surfing on a Mac, for instance, you can go private browsing if you feel like it, but that doesn't really— that doesn't protect you from this, does it?
Not so much. You know, while there are anonymous browsing capabilities, still, information that we're providing in social media, sites that we sign up to, when we voluntarily provide a lot of information about what we do and who we are, that gives them a lot of data that they can use for advertising and marketing. And, you know, we're often providing way too much information that gives both the good guys and, of course, the bad guys enough data to either, you know, commit fraud or even to sell us something we may or may not want.
What's your advice to people?
Well, certainly, you know, in an age of, you know, cybercrime and cybercriminals and 10, 11 million identities being compromised every year, My first concern is that you protect yourself, that you recognize that what information you put out there on the web ultimately can affect you negatively, that if the good guys are getting it, then the bad guys can certainly get it. Doing things like investing in identity theft protection, anonymously browsing, not signing up and providing the world with all your information via social media, just being smart going forward, because we're coming into what we might consider an Orwellian state. Really? Well, you know, at this day and age, you know, with, uh, web tracking software and, uh, when websites like this that you can go to and they can, uh, find out who you are based on your, your profile and your browser, to me that's a little scary.
Yeah, I hear you. All right, well, you know, the surfer beware, I suppose. It's Robert Siciliano. Great to talk to you. Thank you. Thank you.
