If you’re a regular Naked Security reader, you’ll know we have a pet saying that goes like this:
If in doubt
Don’t give it out
That’s a great rule to apply for your personal data, all the way from your email address to your street number.
So when a store asks for a postcode after selling you something, just smile and say, “No.”
Same thing for your phone number, your street address, your date of birth, your employer’s name, and so on.
You may need or want to give out the data, of course – so that you can have a sofa delivered, for example, or to keep in contact someone you’ve just met in person.
That’s your choice, but think twice before you do it, and don’t let yourself get squeezed into letting personal data slip out against your will.
Assuming there is no legal neccessity to provide precise data, here are two useful tricks if you’re in the UK. The postcode ZZ99 3WZ won’t be accepted by all software out there, but it’s the official code used by the health service to denote “address not known”. And the phone number +44.1632.960789 is amongst thousands of landline numbers officially reserved by the regulator for use in situations such as TV programmes, where using someone’s real number would be inappropriate. (Try +44.7700.900.456 if you need a won’t-accidentally-ring-someone-else’s-phone mobile number.)
When it comes to people you’ve only ever met online, we always urge more caution than ever – even if the other person is far away.
Here’s a scary and tragic tale to remind us that even 20,000km (that’s half the length of the equator, and thus the furthest distance you can put between yourself and another person) might not be enough.
The BBC has just told the story of a 25-year-old New Zealand man, Troy George Skinner, who somehow found the home address of a teenage girl he met online in a videogame chat.
(Many video games include a free, in-game messaging service that lets participants in a multiplayer game chat and text each other while they’re playing.)
Four months ago, apparently, the girl tried to break off contact with Skinner – something that’s hard to do if you’ve let the other person know too much about how to keep in touch with you.
It seems that didn’t wash with Skinner, who allegedly ended up travelling from New Zealand to Virginia (plane to Sydney, Australia plane to Los Angeles, CA; plane to Washington, DC; bus to Richmond, VA) and showing up uninvited at the victims’s home.
Correction: This is how he got to Richmond. @CBS6 pic.twitter.com/JuSc3DO4Sv
— Melissa J. Hipolit (@MelissaCBS6) June 25, 2018
On the way, Skinner apparently bought a hunting knife, a roll of duct tape and some pepper spray – a sinister combination, to be sure – and once at his destination, ended up smashing a window and trying to unlock a door to get in.
The victim’s mother had apparently already warned Skinner off, as well as telling him she was armed, so you can guess that this story ends badly for someone…
…and it was Skinner.
After he tried to break and enter anyway, despite facing a firearm, the victim’s mother shot him; he staggered off, collapsed, was taken to hospital and now faces serious criminal charges, assuming he survives his gunshot injuries.
What to do?
This is a highly unusual story, and we’re not for a moment suggesting that if you have inadvertently let slip your address on an online forum, or if you have voluntarily shared it in an in-game chat group, that you are likely to end up in such a tragic situation.
Nevertheless, it’s a stark reminder of the general wisdom of the aphorism that we started with:
If in doubt
Don’t give it out
Even if the person you give it to doesn’t themselves have any criminal intent, you need to be confident that they won’t share the information, by accident or design, with anyone else.
As any number of data breach stories from recent years will remind us, assuming that a third party X won’t leak your precious data to fourth party Y is a risky thing to do!
Anonymous
I think there is a small typo… about 9 paragraphs down…”…a a videogame chat.” Otherwise, an excellent article.
Paul Ducklin
Typo: fixed, thanks.
Your kind words: thanks again!
Thu Ya Win (@Tyw77)
Jusy? Do you mean just?
Paul Ducklin
Er, yes – fixed, thanks.
serg
and the lesson should be, don’t come to the states expecting to mess with anyone. They all have guns!
Anonymous Coward
I’m not going to make any objective comments about Skinner’s worth or value as a human being.
However, from a purely emotional point of view, I view this story as having a happy ending.
Sounds like Skinner was planning to do something violent and nasty to an innocent teenager, and brought this entirely on himself. And if his bell tolls, maybe humanity isn’t so much the less without him?
Bryan
In light of your phrasing, it’s a shame this article wasn’t written by someone else
https://nakedsecurity.sophos.com/author/john-e-dunn/
(no offense Duck…good on ya)
Anonymous
Good thing the incident happened in the US and not the UK or the girls mother could be charged for shooting the miscreant.
Max
Could be, but probably wouldn’t be, or at least not found guilty, I assume?
roleary
Tony Martin was not prosecuted for shooting an intruder, he was prosecuted for going back to bed while the intruder bled out. If he’d called the police first it would have gone a lot differently, but he clearly didn’t see the man as a threat at that point.
Anonymous
IIRC, Tony Martin was prosecuted and convicted on two charges: murder and attempted murder (there were two intruders whom he shot at, one of whom died). The murder charge was reduced to a manslaughter conviction on appeal. So he was indeed prosecuted “for shooting an intruder”, not for what happened afterwards.
roleary
No, he was convicted for deliberately letting the man die after he shot him.
Had it been America this wouldn’t be a story because six months previously he waved a shotgun in a public official’s face, so he’d have been dead already.
Nobody_Holme
In the UK you would be arrested and investigated, and given you could prove both breaking and entering and threat to life, you would them be released without charge if you did nothing wrong (see tony martin discussion, etc).
This is right and proper, and should not be cause for concern for a reasonable person (in fact, the opposite scenario should)
mike@gmail.com
What was the unfortunate ending? He got what he deserved…
Max
The mother had to shoot a person trying to break into her house violently. I don’t think that is a fortunate ending.
Vytautas
Wow what a story. Now it can make sense to hide real address and maybe even name.
s31064
Now it makes sense? I don’t understand why anyone would ever give out correct information. Even my Google account has me living on an island in the Aleutian Islands and I’m 117 years old. Obviously, neither of these is true.
There was an article several years ago about a cop (don’t remember what city he was from) that spent his spare time on Facebook and other sites pretending to be a teenage boy. He made friends with quite a few teenage girls, then would show up at there houses all across the country. Not to see the girls, to see their parents, to warn them of how much can be inferred from the fairly innocent information and the pictures they posted. He found one girl’s address from a picture of her sitting on the hood of her car. It showed the license plate. Another he found through her cheerleading uniform. It gave him the school, and a few questions got him the rest of the info.
Never, under any circumstances, give out information that isn’t required by law.
Reader
If in doubt
Don’t give it out
* * *
Just your first and last name (surname) and the name of the U.S. state in which you live will do.
Skinner the Kiwi probably used a web site that freely provides the home address of almost any U.S. resident who is at least 18 and who is not powerful or super wealthy.
I know of at least one such site that allows users to filter names by middle initial or by city of residence. From there, the site freely provides a list of all the people in such-and-such state who have a particular name, their current age, their previous cities of residence, their past employers, and their relatives.
The privacy of the powerful and super wealthy in the U.S. is somewhat well protected, as it should be. But no such privacy is enjoyed by the rest of us in the U.S.
chez
I am not all that keen on putting personal photos out there because facial recognition may be rubbish at the moment but it won’t always be. Little tots posted on Instagram may not get a choice.