Did you think having your Instagram account set to “private” means your personal information is completely out of sight?
Ha! Think again.
It turns out that things aren’t quite so simple, and “private” isn’t exactly that private. A new experiment from Compare the Market has explored how publicly available online information can be pieced together to reveal a whole lot more about someone’s life than they might realise. And no, this doesn’t mean someone’s “hacked” into your Instagram account.
It’s actually something that can be done pretty easily and pretty much “above board”, in a way (if you ignore any personal, moral or ethical values, of course). Of course, this points to an issue that goes beyond the fact that your Insta profile may be viewed by people you don’t know. On top of that, it highlights the issue of just how much information we leave behind online without necessarily realising it.
How Much Can Someone Find Out About You Online?
To put this to the test, Compare the Market commissioned Global Protect Risk & Intelligence to investigate the digital footprints of nine UK volunteers. Intelligence Director Colin Crowden, a specialist in Open-Source Intelligence (OSINT), was tasked with using publicly available information to identify the volunteers’ home addresses, property details and whether they were currently away from home.
And the horrifying part is that he was quite successful. The investigator managed to identify the home addresses of seven out of nine volunteers (or 78%) using publicly available information. No hacking, nothing particularly dodgy or dicey: just information freely available in the world.
And most importantly, perhaps, they realised that four of the nine volunteers had private Instagram profiles.
The fastest address was identified in just 15 minutes, with the first lead found after only 50 seconds. At the other end of the scale, the slowest investigation took 18 hours, with the first lead taking six hours.
And that’s not all. The investigation also uncovered property floor plans for four of the nine volunteers, revealing the internal layouts of their homes. And if you’re not yet as creeped out as I was when I first read this, there was one case in particular in which the investigator was actually able to establish when a volunteer was away on holiday, meaning their property was unoccupied at the time.
So, let’s put this together. Imagine that a stranger is able to, within 24 hours, figure out who you are, where you live, whether or not you’ll be home and have an accurate, room-to-room, understanding of the layout of your entire house. That’s just…way too much.
The experiment was designed to demonstrate how information that appears harmless on its own can become exponentially more revealing when combined with other pieces of publicly available information. That is, having access to floor plans seems kind of meaningless for most people when you consider it as a single piece of information, but when combined with an address, the name of an owner, personal info and the individual’s whereabouts, those floor plans are no longer so innocuous.
It’s Not Necessarily Just About Your Instagram Account
It would be easy to look at these findings and conclude that having a private Instagram account is pointless, but that’s not really what the experiment shows. Well, it’s not all the experiment shows.
In fact, Compare the Market’s own advice specifically recommends reviewing privacy settings and considering making accounts private. After all, it’s still better than a totally public account; it’s just not totally safe and secure.
The bigger issue at hand here is actually that your digital footprint doesn’t begin and end with your own Instagram profile. You might post a photograph of yourself outside a restaurant, a friend might tag you at an event, a family member might post a photograph of your house, you might have an old property listing sitting somewhere online, a company website might mention where you work and a public social media profile might reveal the town you live in.
None of these things necessarily seems particularly revealing in isolation. But when you put them altogether and package them up, suddenly, they start to form a surprisingly detailed picture.
That’s essentially what OSINT is about: gathering and analysing information from sources that are publicly accessible.
As Crowden explained in the research, information that appears harmless in isolation can become much more revealing when it’s viewed alongside other publicly available information. And I think that’s, perhaps, that is the bit we tend to forget – I know I do (or at least, I did before I stumbled upon this research).
Public Doesn’t Always Mean Harmless
There’s an interesting and important difference between information being publicly available and information being something that a person actually intended strangers to know.
If I post a photograph of my house, for example, I might not think much about it. Someone else looking at the photo, however, could potentially be thinking about the house number in the background, the street sign around the corner, the school uniform hanging by the door or the landmark visible through the window.
And yes, that does sound like detective work, and it doesn’t necessarily mean that anyone and everyone looking at the photograph is suddenly an investigator. But it does, however, demonstrate how context can change the value of information.
But taking this a little further, there’s something more uncomfortable at play here. A quick search of the web brings up numerous pages claiming to explain how people can view private Instagram accounts. As in, articles written and framed as guides that explain to people how they can bypass app policies and gain access to profiles they’re not supposed to have access to.
Some of these guides are simply describing legitimate options like requesting to follow someone (there’s obviously nothing wrong with that), but cybersecurity experts have warned that purported “private Instagram viewer” services can also be scams designed to harvest information or lead users towards malicious websites. InsideHook, for example, previously spoke to cybersecurity experts who warned against these services that offer to help you view “private profiles” and such, explaining the risks associated with giving third-party apps access to social media accounts.
And so, unsurprisingly, there’s an important ethical line that’s being blurred here. There’s a big difference between finding information that someone has made publicly available and trying to circumvent a privacy control to access information someone has deliberately restricted.
The fact that information can be found doesn’t automatically mean that it’s appropriate to find it. Especially if they’ve specifically opted for privacy and you’re trying to bypass those settings and the user’s wishes.
Warning: We’re Sharing More Than We Think
The Compare the Market experiment was accompanied by a survey of 3,000 UK adults, which found that 41% share holiday updates before or during their trip, while only 14% wait until they get. Another 39% don’t post about their holidays at all.
Among those who do post, 78% said they consider the potential home security implications, but 22% rarely or never do. It’s just not something that crosses their mind, perhaps because they don’t imagine anyone would be keeping track – why would anyone care?
Of course, there’s nothing wrong with wanting to share your holiday. But the point is simply to think about what those individual pieces of information might reveal when put together. And ultimately, we can probably all think a little more about how we share, when we share and what we share. Something as simple as waiting until you get home to post content can make the world of difference (kind of how influencers don’t post about places until they’ve left).
So, Should You Make Your Instagram Private?
Straight off the bat, this is obviously a personal preference and it’s up to the individual. But if you want to be conscious of privacy and security, then yes, you probably should. But don’t stop there.
Compare the Market recommends waiting until you return home to share holiday updates where possible, reviewing privacy settings, turning off location tags and being mindful of things like house numbers, street signs and recognisable landmarks in photographs. It also suggests regularly searching for yourself online to see what information is publicly accessible. Because your Instagram might be private, but your digital footprint is much bigger than your Instagram account.
And perhaps that’s the biggest lesson here: privacy isn’t just about hiding one piece of information; it’s about understanding what all those little pieces can reveal when someone puts them together.
