Please view the main text area of the page by skipping the main menu.

Doxers can extract personal data from seemingly harmless social media posts: Japan experts

Users should be careful about posting graduation photos on social media. (Getty)

TOKYO -- What are you revealing about yourself in your social media posts? Perhaps much more than you think. Japanese cybercrime experts are warning that everything from talking about blackouts to photos of graduations, backpacks and even bubble tea can unwittingly reveal your personal details to the wider internet.

    So, what kind of posts can be risky, and what should people do?

    "The user's neighborhood may be discerned from things like photos of diplomas, blackouts and IC commuter passes hanging from backpacks, even without the user knowing they've given anything away," said Yuho Kameda, 36, an engineer at major Tokyo-based IT services company SCSK Corp. Kameda and his colleagues have held events for other engineers since 2016 to enhance their information collection skills. Kameda creates training exercises challenging participants to identify where a photo was taken -- a type of "open-source intelligence," or tapping and analyzing publicly available data.

    He first pointed to diplomas as "a type of social media post that users should be careful about."

    Personal information can be extracted from posts about a natural disaster. (Getty)

    Many people post photos during graduation season, which is typically March in Japan. Even if a grad hides their name and that of their institution, the distinctive design and color of their diploma can allow someone to identify the school. Graduates may be happy to be starting a new chapter in their lives, but they should resist the urge to throw photos of the event up on the internet.

    People also tend to have a blind spot when it comes to posting about unfolding disasters, Kameda said.

    "It's especially easy to extract location information from posts about lighting strikes, because you can narrow down where they happen," according to Kamada. If a lightning strike causes a blackout, electric power companies release the location almost immediately to let residents know, regardless of the blackout's scale. It is the epitome of open information, and a social media user's neighborhood can be identified from the time and what's visible in a posted photo. Furthermore, a user's location can be narrowed down to "within 10 buildings" depending on the blackout's scale. People should think twice before posting things like, "There's a blackout here."

    People may need to be careful about how their backpacks and bags appear in shots as well. Even if their faces are not visible, a photo of an IC commuter pass hanging from a backpack or bag may reveal the train station nearest to their home, school or workplace. Kameda emphasized that "even if the image is unclear, there's technology that can make it legible."

    The view reflected on the surface of a tapioca ball may allow someone to identify where the photo was shot. (Photo courtesy of Yuho Kameda)

    In an exercise Kameda made for his fellow engineers, even a photo of bubble tea contained a hint about where it was taken. The location could apparently be discerned from the reflection on the surface of the tapioca balls.

    Some self-proclaimed social media "doxers" -- people who track down and release others' personal details online -- get the information by analyzing seemingly innocuous posts. In one case, an obsessive fan tracked down a female pop idol in part by spotting the name of her local train station reflected in her eyes in a photo posted to social media. He later attacked and injured the woman.

    And the ranks of the online doxers are swelling year by year.

    "There's a serious identity issue at play," said Setsunan University information science and profiling professor Daiji Hario. He continued, "What one does online doesn't seem very real, but people increasingly seek to sate their desire for real-world impact through social media connections. The feeling that they are shifting society validates their self-esteem, desire to dominate and need for approval. Internet users are always seeking new information and stimulation. The increasing doxer numbers may reflect such feelings."

    Then, how should we protect ourselves on social media? Hario advises that staying anonymous is of utmost importance. You should set your privacy settings to prevent anyone except those you've personally approved from seeing your posts, plus any personal information disclosures including of your profile or even your profile.

    Hario continued that people should blur the background of any photo or video they post to social media, and avoid any posts that give away the time and location simultaneously. In particular, posting things happening right in front of you during your commute can reveal part of your daily travel route, raising the risk that you may be targeted by a stalker.

    In addition, regularly checking past posts is important, Hario said. Doxers mine targets' social media feeds for personal information, so it's important to delete even the dustiest of your old posts.

    Also, it is better to avoid using the same account name for multiple social media platforms, such as Twitter and Instagram. If people figure out that a person has multiple accounts, there is a higher risk of personal information extraction. You should also be using different account names not just for social media, but for other online services such as the flea market app Mercari for the same reason.

    Hunting down personal information like this possibly violates privacy, defamation and other laws. Hario commented, "There are probably quite a few people trying to identify people online without recognizing that they could be violating the law. We need to thoroughly inform people of these risks."

    (Japanese original by Tadashi Murakami, Sports News Department, and Harumi Kimoto, Digital News Center)

    Also in The Mainichi

    The Mainichi on social media