Personal data discoverability to human searchers: Observations on personal data availability

Abstract

Personal data is widely and readily available online. Some of that personal data might be considered private or sensitive, such as portions of social security numbers [1]. Prior research demonstrates the knowledge of personal acquaintances of data used in secondary authentication protocols [1]. We explored discoverability and location of personal data online and gathered observation actors making the data available. To empirically understand online data discoverability, we sought to identify select personal data of 32 volunteers. United States Naval Academy (USNA) Midshipmen and recent graduates of the USNA cyber operations major used publicly available online information to assemble personal data of participants. On average, the investigations took 10–20 min and accurately recovered substantial personal data. Of the sample, 68.75% of mother’s maiden names, 34.38% of nicknames and 28.13% of mobile phone numbers were accurately identified. Searchers noted that data was most readily obtained by performing a “social pivot” from the original participant and tracing social relationships on commercial sites (e.g. WhitePages) and social media (e.g. Facebook). Personal data was most frequently revealed as a result of social connections rather than direct, first person information provided by participants though their own web presence. Measuring the discoverability of personal data online provides insights into data vulnerabilities and actors in data availability. Data discoverability has ramifications on discussions of privacy beliefs and behaviors and current and future authentication protocols.