The Internet--a private eye's best friend

NEW YORK--For private investigator Steven Rambam, the Internet is his most valuable tool in helping to find missing persons, cheating husbands, and your competitor's dirty secrets.

Steven Rambam, director of investigative agency Pallorium, tells the crowd at the Last HOPE conference that "privacy is dead."

(Credit: Elinor Mills)

But while the intelligence business is booming, individuals are losing the battle to protect their privacy with every blog post, Google Web search, and online photo, Rambam, director of the Pallorium investigative agency, said in a keynote session late on Saturday at the Last HOPE (Hackers on Planet Earth) conference.

"Anything you put on the Internet will be grabbed, indexed, cataloged, and out of your control before you know it," he told CNET News after the session. "The genie is out of the bottle. Data doesn't stay in one location. It migrates to hundreds of places."

Information that he used to have to search for or dig up in far away places is now available at his fingertips. All types of information is being digitized, older stuff is being scanned and put online, and it's all being aggregated into uber-databases that are being sold to marketers, government agencies, and anyone else who can pay, he said.

Rambam says he searches on social networks to find photos of what people he is researching look like, the first step in any investigation. He gets a lot of other vital data from those sites, like hometown, age, relationship status, school and work history, hobbies, and friends and acquaintances to interview. With Twitter, he can often see where they are right now, or at least in the recent archived past.

"I used to pay the police $500 for a driver's license photo. Now I just have to go to MySpace," he said. "I can find your location without leaving my desk."

He uses job sites to see someone's resume, date of birth, address, and work history, to find former employees of companies he is researching and to see what job openings they have and compare salary levels. And then there are sites like Don'tDateHimGirl.com and Who'sARat.com where you can find what a person's enemies have to say.

Rambam also gets information from marketing databases that gather information on people's buying habits and preferences from frequent customer cards, surveys, product registrations, actual transactions, and other activities.

Marketing databases with vast amounts of personal records are being purchased by the government, he said. At the same time, individuals have less power to learn what information is being gathered on them and how it is being used, because private entities are exempt from the Freedom of Information Act, he added.

"Dominos has built the biggest consumer database in America," and the U.S. Marshall's Service, the New York Police Department and collection agencies are using it to track people down, Rambam said.

There also are vast stores of data based on peoples' Web and computer activities being amassed by technology companies that can be easily used to connect a specific individual to specific activities and information. For example, end user license agreements allow for location data to be sent back to the manufacturer every time a customer logs in, and photos and burned CDs and DVDs have unique serial numbers for tracking, he said.

Then there is the "snitch" in everyone's pocket--the cell phone. Unlike your activity on a computer, "a cell phone can be immediately traced to you and you have it with you 24/7," Rambam said.

"Cell phones change everything," because of their location-based technology, he said. "I'm able to know who you talked to, where you are, what you do, and what you like just from cross-referencing cell phone (data)."

Finally, cameras and video cameras have helped revolutionize the snooping industry. Smart cameras with facial and activity recognition analytic capabilities are popping up everywhere, while the FBI and others are testing systems that will recognize the walking gait of individuals, Rambam said.

There are police helicopters in New York that can see what a car passenger is reading. New York is partnering with businesses and landlords to install 3,000 cameras in lower Manhattan and has spent $450 million to install 3,000 cameras in the subway, he said.

In a test of his skills, Rambam tracked down someone who had agreed to go in hiding for one year. He was able to locate the person nine times, using methods including social engineering and a dummy e-mail account, tracking the IP address of an Internet cafe computer, cell phone triangulation, a credit card trace on an airline ticket using a frequent flier number, a fake Match.com ad, and an online "wanted" poster.

Rambam, who details the experiment in a book titled Stealing Your Own Identity, also was able to track his subject through his pharmacy and doctor.

And in an ingenious move, he noticed that there were blocks of photos with consecutive unique IDs on the subject's Web site that were missing. So he searched for photos with ID numbers that would fit in that sequence on Flickr and found shots that gave away his target's whereabouts.

Although he works closely with law enforcement agencies, Rambam has had a legal run-in of his own, just like some of the hackers in the audience. He had been scheduled to speak at the previous HOPE in 2006, but was arrested right before he was to give his talk and spent two days in jail on charges of impersonating an FBI agent and tampering with a government witness. The charges were dropped and his accuser now faces arrest, he said.

New York City is installing video cameras all over the city, Rambam says.

(Credit: Pallorium)

[Penguinisto]

Meh - Good luck... I have a pretty common name, and there's lots of me (even in the company I work for, where I've lost count of how many times somebody confused me for another in email).

For stuff that is important (financial details, home address, etc), a PI would have a fairly hard time of it, since I don't post them anywhere publicly. Internet stalkers have had a so-far impossible time of it (ask some of 'em in here :) ). Unless I specifically tell someone, it seems that most attempts have led down a myriad of blind alleys.

Not that this makes me complacent, but something else to consider: If I truly wished to disappear but still stay online, it would be almost trivially easy to do. My ISP allows me to change my email address at whim, and the rest is drop-easy.

[rapier1]

Well, the thing is most PIs are hired by people who actually have some starting information. So it wouldn't just be just your name but likely your name, an address, your employer, maybe a phone number, or birth date. Once you have some of that information its possible to find more unique identifiers which can be used for more in depth searches using a variety of data stores (not just google more like PSP PATCH and so forth).

[catbutt5]

How is he getting cell phone triangulation data?
I mean, I see he's bribed police officers in the past - PI's and a lot of police are nothing more than criminals in disguise - he clearly has no qualms about breaking the law himself...
Privacy is only dead because so many parasites like this guy will do anything including selling out his fellow man, for a buck.

[Imalittleteapot]

There is probably something illegal going on or at least something that should be illegal. Oh, he got ahead by breaking the law or violating my privacy like looking at my cell records which should be illegal or by looking at my medical records which should be illegal. Do you want a cookie? I suppose I could be a millionaire too if I just sold drugs right? Try playing by the rules and with some morals and this person doesn't stand a chance, but it doesn't matter. The PIs, cops, and even the government don't really play by the rules or respect the privacy of others. We already know there's too much personal information out there. It's all out there and the guy thinks he's a genius for finding it. Duuuhh. Oh well, he can find out all my financial info or go to all pages I visit to find out all the personal information or figure out my medical records. Oh well, what is he going to do with it? Pleasure himself while he reads it? Oh noes, you got all my MySpace info off my profile that I put up there for the whole world to see. It's information that all my friends and family already know. OH MY GOD! What am I going to do! Is he going to use super cameras to find out I'm doing his mom? You can put me in jail for it. The only lesson to be learned is that if you're a fugitive you'll probably get caught unless you're not a priority. If you are a priority you're probably going to get caught. However, if this guy is so darn good maybe he can go find Osama. I hear that guys been in hiding for a while.

[N2JDJ]

Want to get lost and dissappear permanently? That's easy, lose the cell phone, lose the credit/debit cards and use U.S. Postal money orders to pay your bills. E-mail providers are available to create and use e-mail addresses for only 10-15 minutes, then they dissappear. Never put any land-line or cell phone in your name. Never put any utilities in your name. Do not ever join any discount cards or programs at any store. Do not sign up for any kinds of promotions. Create and use an L.L.C. or an L.L.P. for any ownership of anything including the creation of an Employer I.D. number for use with the government agencies. Transfer your properties to another name (straw man) and use a lease-back contract to control your rental units etc. Stay the Hell off of ALL of the social networks and databases. De-personalize your computer, as well as all of your user names...NEVER put any personal info into or on your computer. Use an anonymous V.O.I.P. phone such as Vonage or Magic Jack using a number that is in another state etc. etc. etc. In other words use your brain and stop being an irresponsible "BONEHEAD" internet/cell phone/electronic junkie!!!

[WJeansonne]

You sound like a paranoid criminal. Are you?

[anomalator]

So let me get this straight, he challenged someone to go into hiding for a year, and while that person was hiding they used their credit card, frequent flyer miles, email, a cell phone and posted photos on flickr. Are you frickin' kidding me!? This "person" must have been a complete moron! I don't really see where there was any challenge here. Any teenager with access to the web could have found this "person". Yeah, that's quite a set of "skills" you have there Mr. Rambam!

[mrcoder]

This is an amazing article because it puts everything together.

I am sharing this with my friends.

[Edwin-]

What the hell do I care if he can find out where I am, how many pizzas I order a month, or all of my purchases at Best Buy? He still doesn't know where the loot from that bank job I pulled last year is stashed.

[atcj0611]

Shhhhh! I told you to shut up about that man! DAMN! lol

[glynisc]

"Dominos has built the biggest consumer database in America," and the U.S. Marshall's Service, the New York Police Department and collection agencies are using it to track people down, Rambam said....

This goes beyond how many pizzas you order. Is no one else concerned about the distribution of private information between a retailer and government agencies?

[private-internet]

I don't think we should accept the status quo. The issue of privacy is important and technology wise, there is a solution - its just a matter of time for the public to realize its importance

[michaelo1966]

He's admitting to bribing the police; sounds like a high-priority investigation is in order followed by a long jail term for him, and an even longer one for the dirty cops he's worked with. Mideastern terrorists are a concern, but creeps like this guy and the criminal cops he works with are more of a threat to the country's well being.

[mnovickar]

Great perspective-gathering look on what "social media" has done away with what used to be respected as personal privacy.
Nowadays it's not only the cost of doing business but the price for having an identity.
[CNET editor's note: link deleted]

[inachu]

Spouting off things found by using Google I will laugh so hard!
So Inachu! I see you have a nice collection of Dr. Who...... ERRR wrong! misinformation.
This would make the P.I look like a complete noob.

[Harrison912]

As a website owner of safety and security products, I say, if you're not doing anything wrong, you don't have to worry.

Why try to hide if your conscience is clear?

[The_Decider]

Spoken like a true moron.

I see you didn't post anything that could ID you. You must have something to hide! I hope CNET turns you in.

[chash360]

That argument works only if everyone is as honest as you claim to be. Just because your not doing anything wrong does not means they can not claim and convict otherwise. They can manufacture any electronic evidence to support their case against you should they have reason.

I wish the world was so good, but then there is reality to deal with....I would wear a wireless cam 24/7 to prove I am honest and good but then they would just throw that evidence out if they had enough motivation to silence me.

Do I sound paranoid enough yet?

[gazz27]

If one really wanted to "disappear" they would know better than to use anything with their name on it (internet, cell phone, credit card, etc.). I do remember reading a previous comment which expanded on how someone would go into hiding and it was basically a "how to go into hiding for dummies overview". But who cares if someone knows what you're buying, where you went on vacation last summer, etc. as long as everything you're doing is legal. Yes, the thought of a "stranger" knowing your personal information is scary, but anyone with a brain will know that anything and everything you do on the internet is being tracked. The truth is that the internet itself has morphed into one giant social tool, you can meet anyone, and buy almost anything you want with a few mouse clicks; the same is for anyone who wants to find information about someone. So is this the end of personal privacy? Not necessarily. It's just like what I said before, all you need is a brain.

[tremorfireheart]

For all of those who are claiming that hes bribed the police by paying the 500$ for the drivers license photo, keep in mind that in most states you need 6,000 hours (3 years) of experience in police and legal work before you can qualify. They also have to explain to the judge and jury how he acquired each piece of evidence. I find it highly ulikely that he would admit to something illegal in the middle of a public forum. I'm sure it was some sort of legal access fee placed on him by the local law to get the photo.

[kristimetz74]

This guy is a total blowhard. There's no way he's getting his hands on anyone's cell phone data. He's full of it.

Information online is a concern... you can find out about almost anyone. Privacy is not a priority to this government... corporations are. In other countries, things are different.

[jssshashi]

Move out of United States of America...

[TedInAK]

Anybody but me wonder why it costs NYC $150,000 to install each camera in the subway? ($450,000,000 / 3000 cameras = $150,000) Sure wish I had that contract.

[tremorfireheart]

it probably has something to do with installing new servers to handle the information processed by the camera. 72 servers and about 50 computers(for employees to work with the servers) are worth about 1.5 million $. Video storage can easily hit terrabyte storage limits quickly. I'm sure they also want to look at the video scans in a month or possible a year from now. I'm sure that they are using raid configurations to improve data reliability. then you probably have to worry about the camera prices them selves, the running of cable, the price of cable, the running of fiber channels between stations for high speed connections to handle the video stream. Also in each station there would have to be a wiring hub and rack to route traffic. For the new racks air conditioning and power considerations may be required. Power may also have to be run out to the locations of each individual cameras so they have power to run on. If a brand new server room is created then fire protection can cost several hundred thousand. Then of course the man hours and salary involved for those running cables,those setting the cameras, those installing the servers, and those installing protective measures for the servers. it all adds up quickly.

[easonchan]

well that's for sure. the internet is just THE database that's accessiable to anyone anywhere anyhow. if anyone ever checked, the internet was developed FOR THE CIA/Military. not too shocking

[teraphim]

The failure of any institution to protect citizen's rights in regard to official commercial media exacerbates the consolidation-access problem. I was personally the victim of journalists and tv news reporters who twisted a situation I was in to write an utterly false story that they regarded as "hot" for their readers. In the case of the TV news, the local NBC station spliced parts of an interview with their own questions to invent a situation, and other news stations just copied NBC and pasted my picture everywhere.

There was nothing I can do about this. No journalism oversight agency existed to intervene, and no heroic lawyer bothered to intervene to protect my rights (especially since the media lie already put me on the bad side of public opinion). This official media was copied by bloggers, who of course added their own outraged opinions based on completely false information.

Because of the Internet and Google, this false story will define my life forever. I'm unemployable. There's no chance of even temp work turning into something permanent once my colleagues and boss start Googling me. If I never even get an interview in the first place, there's no way I can prove that I was excluded through Googling, so I would have no legal recourse even if a chronically unemployed person could afford a good lawyer.

I often wonder how many other people are in the same situation. I wonder how many people with a name similar to mine might also be affected by invisible Google-based prejudice. Perhaps this seems extreme, but the only solution I can see is some power of information-freezing reverting to the individual citizen. That would mean that upon any personal information leak complaint, any web page (not whole site) would be rapidly blocked by the web host (and expunged from Google) until complaint is resolved or shown to be spurious (i.e., no identifying information, intent to harass web site owner). Because of what happened to me, I include in "official media", such as newspaper web sites under this blackout power. Newspapers would be required to resolve any non-public-figure complaining about how they were used for story before the story can return to be posted on the web. It seems to me that any important story can be told without using the names of non-public figures, and if they are doing the right thing journalists are likely to actually get permission to publicize names.

If this seems like some radical call to block freedom of information, think of the people like me whose prospects in life and relation to society have been utterly controlled and ruined by the agendas of powerful information purveyors. The rights and protections of the individual should be the most basic of society. Unless my behavior is posting some dire threat to others (re: I'm wandering around waving a knife at random people) then there is absolutely no reason society in general needs to know *anything* about me. I should be able to support myself through work based only on my skills and qualifications. I should be able to meet people and make friends based on my interaction with them, not a Google dossier.

Of course the right to privacy decreases surveillance of society, and could ease the commission of crimes. Because of this, the increased protection of privacy should be balanced by increased options to *privately* arbitrate disputes and convey information to law enforcement personnel. Right now the collapse of privacy is being accompanied by decreasing access to justice for the "little people". Most people can't afford even minimal use of the legal system, and everything done there goes into the "public record", and potentially the Internet. This is a recipe for human rights disaster. This can only be reversed by actively protecting privacy while increasing means for problem resolution and access to justice at the lowest levels.