Cyber Crime - EB and the Tinfoil Hat

I remember in a thread a while back where EvenBob was being teased about his "paranoia" because he wouldn't get a players card or give casinos his drivers license. AZDuffman's recent thread about credit/identity theft sparked a memory that I thought I'd share. It really blew my mind.

Backstory - My job requires knowing who people are. Whether it's APs, theft, people losing money, dine and dashes, hit and runs, money laundering or counterfeiters, we are expected to be able to identify people for casino security and law enforcement. We will often perform excersizes on slow days to keep us sharp, and the last one I did left me speechless.

A random patron was picked out of Table Games. This patron was a refused name, they provided no players card, just a face in the crowd. The scenario was this person pulls a gun and shoots the dealer. I have 1 hour to find as much info on this patron as posssible. I can use the cameras, the internet, our weakest player database, and that was it. Ready, set, GO.

The database used was simple, it was the one Promotions would use. Nothing about play history, or game history, how often you come, none of that. Just the stuff you would give to get a players card. The internet, I went straight to social media. The cameras I used to back track and identify people she was with. These people were using a players card, and I could identify them. Hit their social media, and sure enough I see them friends with our shooter and get a name. Recheck the database, and sure enough they was in there. I continued on.

40 minutes later I called an end to the excersize, and I really couldn't believe what I had to show for it. Keep in mind, I am no computer whiz. I am not a haxxors beast, I'm not cyber anything, hell, some of these I can barely turn on. And the stuff I accessed was done so by direct means, I simply went to info available to the entire public. In those 40 minutes, I had this person's name, birthday, current address, address of former home, where they lived currently, where they just moved from, where they grew up, phone number, social security number, college they went to, major and minor, degrees received, where they spent their free time, countless friends and family contacts, it just went on and on. And I'm sure if any one of them had ever been to this casino (which all three of the friends they were with were), I could likewise get all this info on them, too.

It just made me think: How many places have your personal information? Banks, DMV, credit companies, doctors offices, HR department, your job...and within these places how many people have access to it? How many IT, how many clerks, how many doctors, nurses, DMV personnel, loan officers, HR personnel, etc and so on. In my small casino, I suspect approximately 300 employees are in a position where they have access to your info, from all of Table Games, to the Slot Attendants, to the Hotel Desk, to Promotions, to the Cage. That's ONE BUSINESS. And how can you prevent from giving this info out? Really, you can't. You might refuse a players card, but a job? Health care? Driving priveledges? It just made me think how much of "me" is out there, waiting for someone to take it.

How can one protect themselves in the computer age?

Scares me. Even if you try and leave a small footprint,
leaving no footprint is impossible. Most people don't
know that a casino wants your info for themselves,
not because they want to do you favors.

Don't have any accounts on sites like facebook.
If you need an account to access stuff, keep a random fiction one.
If you need your friends to identify you, use a variation of your name or a similar sounding one.
For example, Paul Denton -> Pol Danton.
Use a profile photo that's too distant and too low-resolution to properly see your face.

Never specify anything in your account that isn't required.
When personal information is required but not verified, provide fiction.
Don't use the same fiction for every single website, randomize between groups.
If you have to specify a birthday that may be verified, change one digit like a typo.
Keep access to any real information "friends only", never "friends of friends".

Have a separate email or several for sites that require correct personal information.
Never use these email addresses for any purpose other than for these websites.
Never link from your real-name pages to your pen-name pages or vice versa.
Use unique nicknames for every website, including real-name websites if possible.
Maintain multiple compartmentalized groups of accounts that might be linked.

Use at least two proxies: a general http proxy and an end web proxy, from different countries.
Use different site-end proxies for every website and change your http proxies like underwear.
Maintain one or more realistic looking assbook pages with detailed but fictional information.
Only use names and places found on the web for your fiction, not from your life experiences.
Whenever a real name is expected but not verified, use one for which you have a fiction page.

Avoid any quirks in your writing style and vary your spelling between UK and US English.
When talking to strangers, give them a nickname or an alternate version of your real name.
In any stories you tell, change at least one potentially identifying detail - time, location, other.
When in doubt whether to reveal something, ask yourself if you would gain anything by it.
Wear sunglasses at night.

My uncle was a detective on the Baltimore police dept. back in the 60's and 70's. He could walk into a bank and without a warrant get the bank to let him look at your checking account. Just from that he could tell salary, poker night, etc. Boggles the mind to think what
Big Brother can do now . And almost all of it without a warrant.

But of course no law officer would ever hack into your computer, files at work, etc BET ME I think our criminal system has a lot of protections for the average citizens. But too many convicted rapist are free today due to DNA. Same for guys on death row.
You think cops and DA's are interested in conviction?

Most DA's fight DNA evidence where it surfaces after somebody has been found guilty. Last I knew only 5 states recorded the entire interrogation sessions. Most don't record them at all until the guy is ready to confess. If you have never been stopped by the cops for DWB, then you are not black !

P90 Just because you are paranoid, does not mean somebody isn't out to get you . LOL

So a great deal can be found about you anyway, and not signing up or not using a player card is therefore foolish?

"Most secrets stay secret because people don't care." Emmanuel Rubin in some Black Widower Story

Face, if you don't mind me asking, where did you find this person's SSN? If you can't say exactly, what kind of site was it on? I understand if you can't say at all, just curious. That's the only one that really frightens me, to be honest. I only give out my social to banks and other financial institutions, and I can't imagine how it would get out of their website into somewhere that would be searchable on the general web.

Face reminded me about this thread. Now my local supermarket
has us swipe a 'rewards' card before we can get any sale item.
This keeps track of every item you buy in their chain of stores,
and they share the info, it says so in the fine print. Every carton
of smokes, every bottle of booze is now in some database with
the buyers name and address and email. Big Brother isn't just
watching, he moved in next door.

Quote: EvenBob

Face reminded me about this thread. Now my local supermarket
has us swipe a 'rewards' card before we can get any sale item.
This keeps track of every item you buy in their chain of stores,
and they share the info, it says so in the fine print. Every carton
of smokes, every bottle of booze is now in some database with
the buyers name and address and email. Big Brother isn't just
watching, he moved in next door.

Wow! I'm surprised they have your name & all that. My supermarket has the cards, and they track what I buy, but they don't have any of my personal info - they just handed me a card one day.

Quote: AcesAndEights

Face, if you don't mind me asking, where did you find this person's SSN?

Yeah, I'm curious about that myself. SSN's are usually more difficult to get compared to all the other info.

Quote: rdw4potus

Wow! I'm surprised they have your name & all that.

Yup, they even send stuff to the house, they have
my address. And they verify your email too, they
send you a code you have to enter to activate the
card. It's pretty spooky. But Sam's Club and the rest
have been doing that for years, they know everything
you buy.

Quote: Beethoven9th

Yeah, I'm curious about that myself. SSN's are usually more difficult to get compared to all the other info.

Something I always thought was odd was, when you die
your SS becomes public knowledge. For years crooks
have been finding people born when they were born,
same race and area, and using the dead guy's SS. You
can often see an SS just looking at Ancestry.com

Quote: AcesAndEights

Face, if you don't mind me asking, where did you find this person's SSN? If you can't say exactly, what kind of site was it on? I understand if you can't say at all, just curious. That's the only one that really frightens me, to be honest. I only give out my social to banks and other financial institutions, and I can't imagine how it would get out of their website into somewhere that would be searchable on the general web.

Missed this when it was asked...

It was the player database. If you give your SSN to Promotions, hundreds of casino employees potentially have access to it. If you apply for a job here, many more do. It really boils down to what Nareed said, the only reason secrets remain secret is because nobody cares.

Quote: EvenBob

Face reminded me about this thread. Now my local supermarket
has us swipe a 'rewards' card before we can get any sale item.
This keeps track of every item you buy in their chain of stores,
and they share the info, it says so in the fine print. Every carton
of smokes, every bottle of booze is now in some database with
the buyers name and address and email. Big Brother isn't just
watching, he moved in next door.

It's crazy. I don't do rewards type programs or sign up for anything, really. Besides my Field and Stream subscription and buying USAHockey insurance, there's very little I reach out for. That doesn't stop me from getting e-mails for penis pills and Loius Vuiton luggage and a hundred other things totally unrelated to what I do or what i search online. I even get the weirdest snail mail, non stop. It never ends.

Quote: rdw4potus

Wow! I'm surprised they have your name & all that. My supermarket has the [rewards] cards, and they track what I buy, but they don't have any of my personal info - they just handed me a card one day.

If you have ever used a credit or debit card along with your supermarket reward card then they know everything about you.
Those so called loyalty or reward cards aren't for the customers benefit as my wife seems to think.
Hence the mountain of junk mail that comes through the door.

Quote: Face

That doesn't stop me from getting e-mails for penis pills and Loius Vuiton luggage and a hundred other things totally unrelated to what I do or what i search online.

Me too.

The one website I hate is that bullsh*t http://www.mylife.com. It's scary how much info that site has about people.

Quote: Face

That doesn't stop me from getting e-mails for penis pills and Loius Vuiton luggage and a hundred other things totally unrelated to what I do or what i search online.

It's worth spending a few dollars / pounds a year and buying your own domain for your email.
You can create any number of addresses to sign up for stuff when needed and then delete the address, no need to worry about it being sold and ending up on a marketing list and flooding your inbox.
Apart from that your own domain always looks that little bit better than having a hotmail, gmail or yahoo address, plus those big name email .coms are always susceptible to attack.

Quote: Face

That doesn't stop me from getting e-mails for penis pills. ds.

Face, how did they get your penis size, what kind of forms
have you been filling out. Is that a question women at online
dating sites want to know now?

Quote: EvenBob

Face, how did they get your penis size, what kind of forms
have you been filling out. Is that a question women at online
dating sites want to know now?

I like big guns and loud exhausts. I reckon I'm being profiled XD

Quote: Face

I like big guns and loud exhausts. I reckon I'm being profiled XD

Lol, that must be it. You guys are always over compensating by getting really
big guns and playing too much hockey. The hockey insurance was the tip
off, I think.

Quote: EvenBob

The hockey insurance was the tipoff...

Hockey Insurance requires you to take the tip off? Ouch.

I had a friend who tried a discount on his hockey insurance for being a professional hockey player. Until an underwriter
found out he played for the Toronto Maple Leafs.

Quote: rdw4potus

Wow! I'm surprised they have your name & all that. My supermarket has the cards, and they track what I buy, but they don't have any of my personal info - they just handed me a card one day.

For Fred Meyer, the card doesn't actually get you a discount, you just accrue "points" which are then mailed to you as a discount coupon every quarter (very similar to cash back on free play on a player's card). At the current rate, it amounts to 1% off everything. So if you want the 1% discount, you give them your address.

Sometimes I need to find stuff out about someone. It's just not that hard. Now with Google Street View I can even get a picture of their residence.