Privacy Incident Response: What to Do After Your Data Is Exposed

I'm I'm actually, you know, I said, you know, Derek is one of my favorite. Ivon is also my favorite number one because he's going to sign my hat later and I'm going to have a YouTube star. Uh he is actually a very famous streamer on YouTube. Um if you didn't know, he's he's the most he's the most watched uh I guess presenter we we've ever had at Bides. So without further ado, I guess you know he did something you shouldn't have, but welcome Ivon. Thank you. >> Thanks so much. Appreciate it. >> All right, I'm going to hold this mic. Hopefully it's not too close to my face. If it gets too loud, tell me to shut up

and that's okay. Um, sweet. So, welcome to my talk today on I guess it's digital privacy and we're going to talk a little bit about privacy instead of response. Um, and the title of my talk is I did something I shouldn't have, which I'll explain in a second. This is not me, but um, it's a little bit of of a story. I'm going to tell you real quick about me. And uh, we'll we'll we'll we'll do this as fast as I can. Uh, my name is Ivonne or Lev. Lev's kind of my handle that I go by. Um, I also go by a bunch of different names, uh, which you'll see we'll talk about a little bit today.

Myrtle is probably one of my favorites. Um, but it it depends. Uh I you don't need to choose the same name twice which I'll talk about in a second but these are all my different aliases that I also go by. I there are more in fact and some of these might or might not be made up. Um and then I am currently a technical marketing engineer. Uh I work in network detection and response and I work at Corite and it has been an amazing journey. If you want to talk to me a little bit about that that'd be great. Um, I've also been an instructor and department head on a bunch of different cyber security or in in different cyber

security capacities, including at conferences in the B sides throughout Utah. I'm on the board with the Utah Cyber Security Society here, and I love these venues. So, thank you so much for coming to you all and hopefully we'll gain something more. I also used to work in foreign languages, which has been great and uh I love that. And like I said, I do NDR right now. Um, my passion is in networking. I love computer networks. I think they're awesome. Subnets get me excited. Most people barf, but that's me. Uh, and so home labing is part of that. And I've recently been on a privacy journey. And I'm going to go off screen here for a

second. But what I have loved about privacy is my ability to um hand out information all willy-nilly that doesn't actually tell you anything about myself. So, one of the first things I'm going to do because this was a hit last year, and for those of you who are sitting in the front, this is great, and I appreciate that. Um, I'm going to give you all my credit card number real quick. And so, I'm going to put it right here. The uh this is a single-use credit card. You can use this credit card number. The first person to use it gets up to $10 free. So, if you want to use this credit card real quick, you can. I don't care

where you redeem it. I don't care how you redeem it. I don't care what name you put under the name. I don't care what address you put under the address, but this is my current credit card number. Um, use it somewhere and then it's up to $10. If you put $1 and get greedy, somebody's going to come in front of you and use it. So, free 10 bucks right here. You can put any name, any address, I don't care. Use use Myrtle. Use Myrtle. That'd be great. But, uh, I'm just going to hold this up here for another second. If you can buy something for $10 or less, the first person to do so will get it for free.

So, um I'm done with that. Now, we're going to have to burn this later, but that's kind of fun. Okay, so enough of that. Um that'll be a good one. Sorry for those of you who are watching on YouTube later. You don't get a chance at that, but that's okay. It's also against YouTube's terms and conditions. Um, now real quick before I get started, if you guys remember Seth, our keynote this morning, he said that in 2024 there was a market size of $277 billion for what? Oh, man. Huh? >> AI. Sweet. Cool. Here's the problem. He didn't say that it was $277 billion for AI. He said it was $244 billion for AI. 277 billion is how much money was spent

on data brokering. So data brokering. Did Eddie do it? I think Eddie's our winner. I think Eddie got 10 bucks and it worked. >> It was like six bucks, but >> Okay, it was a Okay, he got something for six bucks for free. I'm going to get a notification about 5 seconds that somebody purchased something for 10 bucks or less. You're welcome. I'm glad it worked out. So, and I'll probably get like 15 notifications that say transaction failed. Uh regardless, so uh he said that $244 billion were spent on AI. 277 billion, so more than that, is spent on data brokering, getting your information into the hands of people who want it. So consider that. That's that's larger

than what we were spending on AI in 2024. 2025 is a little bit of a different story where it's the AI is pulling ahead now. But until last year, your your data was more important. I think the reason why AI is bigger now is because it can use your data in other ways. But I'm just throwing that out there to get started. So the background of this preso real quick, um I I gave a talk last year, I guess, besides cash, which somehow blew up. Thanks to all those who commented on it. I don't know if you're here today, but thank you because it made I I'm it's over it's over a third of a million views now on

YouTube. If you're jumping into your privacy journey, I recommend you watch that, too. Not because I care about the views, we don't get any money, we don't get any kickback or anything, but I think it's a good start on privacy. Uh, but I gave this talk and with so many people watching it from around the world, I had a lot of people who reached out to me and asked for advice. They were like, "Hey man, something I don't know what I'm doing. Can you help me out with this?" Or, "Hey, I really appreciated your talk, but this is a question that I have. You didn't cover that." So, I got a lot of feedback, but

I got several people who were asking, "Hey, I'm I'm in a I'm in a bad situation. I think I did something that I shouldn't have, and I gave my information to people I shouldn't have. What do I do now?" And I'm not joking, there were things from like small, "Oops, I gave out my phone number to somebody I didn't want to. What can I do?" to like life-threatening situations. And I I I really appreciate the trust and and and and the understanding that you have or trust to reach out to me. Thank you. Um but I I I don't know that I'm like that kind of a guy. I'm not a lawyer, right? So I just want to preface

that. But I wanted to talk today a bit a little bit about what do I do if I hand out my my information? How do we get back to a place where we feel secure again? Right? Um I had AI make my images. I don't know why it chose a can of or a bottle of spirit in this in this picture, but there it is. Anyway, um but I I truly felt like some of the people who emailed me were in this sort of a situation where they were really feeling, I don't know what's going on, and I'm a little bit afraid for my myself, right, and for my future. So, that's where this presentation

um is going to go. There are two things that I want to give as pieces of advice, and this applies to everybody, not just if you're in a dire situation. And this is kind of the the whole focus of my talk today. The first thing you do is you stop the bleeding which is you stop generating new data or the information that you generate you can throw away as evidenced by the credit card number I just gave you. Um that works and it's all done now. Nobody else can use it. Uh which is cool. I don't know if you know that you can just spin up credit cards. If not, you should try that out. We'll get there

in a minute. Um but you can just spin up a credit card number and give it away and nobody cares. It's like it's totally fine. I think that's awesome. How cool is that? When was the last time you went up and were able to be like, "Here's my credit card number." That's there's there's a level of of freedom and like confidence that you can have as you go down your privacy journey. The second one is once you've stopped that bleeding to then go in and do disinformation and poison the water hole. And I I took a little bit of like experimentation into Photoshop. And so I tried to make Woody look as like dark and and terrible as he

I don't know. It's like poison in the water hole. But if that's I think that's step number two. And so we'll talk about both of these things today and hopefully there'll be some new things that are shared. And if you don't understand the water hole reference, then go back home and watch Toy Story. Um so again, this is just extreme cases. I want to say this quick so that it's also on YouTube. If you're in a legitimately serious case where you're afraid for your life, um call somebody for help. Like reach out to the authorities, reach out to the police, I don't care. Go get somebody that's not me. Um especially if you're in a life-threatening situation. And

then you have to go through and legitimately you're just going to have to reset everything or burn your old life. Like that's we're at a point in time where you can't just hope to get away if you're seriously afraid for your life that you may need to reset your address and move. You may need to get a new phone number. You may need to get him a new email, new social media, new messaging, new everything, right? Like you may need to be in this sort of a situation. Um, but for our case, I just wanted to be aware that this isn't normal. Um, and we'll talk about how to mitigate some of these things uh, today. So, let's start with step

one, which is stop the bleeding with all those caveats out of the way. So, the first thing that you can do, right, let's look at some specific steps we can take to stop our data bleed, right? So, this is my picture of that, right? So, the first thing is stop sharing real data. And I say this like legitimately there there's there's almost nobody that needs to know your name, your address, your phone number, and your email. Like I I can think of very few people in the world who need to know this information. And yet we're we're I don't want to say we're conditioned that makes us sound too much like sheep, but we are. So like

we're conditioned to just think like, oh well, I'm signing up for this service. I have to give my email. Like why? We don't. So how do we how do we get around that? Right? Um, whenever you're asked to provide information, you can give fake or temporary or or burner information like this credit card number that I just had. I can give that out and then if it get gets lost or compromised, I can either turn it off or I know let's say this credit card number is now being used by other people. I'll know where that information was given out and I can trace it back to where that came from, the source of my my information leak,

right? So, if you give out this kind of information, then you can keep track of where it went, who used it, and for what purposes, and you're the one that's in control. So, we'll mention that. And then think actively about what you choose to share. Um, this is one of my favorites. I I don't know if I can share this because of terms and conditions. I recently signed up for a streaming platform, right? Um, and I put in a fake name and a fake email address and a fake credit card number and I started watching a movie and I was like, "Oh, I feel so feel so crazy." like this is cool. And then I was like, wait a

minute. Remember how like 10 years ago I could walk into Walmart or Best Buy and pay in cash for a DVD and then I could walk out and nobody cared? Like why do I feel weird about having like like not giving my real name to Disney Flick Prime, right? Like why why why does that matter? Like why do they need to know my name and my email address? And when you think about it, you're like, I guess they don't. Right? But we don't take that time to just back up and say, "Oh, maybe maybe that's not a good thing." Right? So, think actively about what we choose to share. And it becomes a lot more natural to then not

give out that information. I'll talk about email real quick. I have to breeze through these kind of fast because uh just of the time limit that we are in together today, but I am going to be out here later. I would love to do a Q&A and chat with you all and give you specifics on some of these services and some of these things that I do. uh which isn't the only right way to do them by the way, but we can we can talk more about this afterward if you're interested. Um so you can sign up for an email alias service. Uh the one that that I think is is fairly easy simple login. There's

another one called atti that you can use. They're really they're really easy. You sign up, you put in your real email address and then everything you can create burner emails that just forward to that. So, I could create one that would be what I say Disney flick prime, right, at whatever my address is.com and then and then it'll send it to my personal email without me ever having to give out my my real email address. And then if at Disney whatever from Netflix shows up somewhere, um, then I know that they're the ones who shared that information around. And I think that's that's kind of unique, right? You can buy a domain. Cloud Cloudflare is not a sponsored uh

person, but six bucks a a year for a like it's like 50 cents. So, you can make your own domain and then just set up something like simple login or addi to point to that domain. So, you can have unlimited email addresses at your domain. You don't even need to go through Google to do it or whatever if you if you use Proton. That's another uh brand that I feel okay about. Um you can you can host your domain with them and all your email goes to there. You don't need to use Google. You can use whatever you want, which is awesome, right? That's super easy. And then you create a new alias for every single thing.

Whenever you hand out an email, you create a new one. My favorite one that I just made recently was Hotel Bacteria. It just work like it chooses a random word and it just came out as bacteria. I was like, "Yes, that's the one. Hotel bacteria." So, anytime I go to this brand of hotel, they're like, "What's your email?" I'm like, "Hot bacteria@no.com." Right? Like, so anyway, so and it works and I get I get all their emails, right? And then don't ever ever ever share your real address with people. Right? So in my case, if you want to email me, by the way, I did this last time with Besides Cache. If you would like to email me a

besides or just send me an email and ask me questions or whatever, reach out to me here. I'm okay if you take a picture of this one. If this gets crazy, I'll just shut it down and I don't care if this ends up on some people search website. I know one of you is a problem. Uh but other than that, right, like I don't that's fine. You can email me at besides slcfcrantic 311passmail.net and passforward.com whatever. Yeah. So you can email me here and you will never know what my real email address is because literally nobody in the world does except for me and I'm okay with that. Like why is that bad? Cool. All right. So there's email. If

you want to do phones, um I think the easiest thing you should do is unlock your phone. Not like with your passcode. Uh like unlock it from a carrier. So, get an unlocked phone that you can bring to any carrier that you want. Uh, you can go to certain carriers that have SIM cards that are really cheap and services that are really cheap and you can enter in fake information that works. Um, if you want to get extreme, you can go get a Google Pixel. I know I hate Google, but still. Google Pixel is great because you can then install graphine OS on top of it. Uh, don't ever use a Google Pixel. Oh, I feel bad if that's some of

you right now. So, uh, but just don't ever use a Google Pixel if you're not installing Graphine OS on it. I'll just throw that out there. But you can you can totally go and install Graphine OS over your operating system. It's incredibly awesome. It still runs everything Android. It's easily it's supremely customizable. And the thing that I really like about it, we'll talk about SIM cards in a second, is um, you can disable all unnecessary permissions. So, I can install, for example, let's say Gboard because Google, I think, really legitimately has the best swipe texting in the whole world. Um, so I install Gboard on my on my Pixel phone and then I say you don't get permissions

to do anything at all other than type text and I can remove that and it's it's a containerized environment like no data can get out of it. It's incredible. It's awesome. I love graphos. This isn't a graphino presentation, but it should be, but that's okay. So, uh, then what you can do is if you have an unlocked phone, you can buy SIM cards by the handful. You can get, uh, five for 10 bucks at certain places. And if you want to know which carriers to do that, let me know. And then you can insert a card, uh, go to a place that says we need a phys or we need a cell phone number to sign up.

And then you can take that card and then throw it in the garbage. And that's okay. You signed up for the service and then we they don't need that email or that phone number ever again. And you're fine. Whatever. Uh, that's something that's really easy to do. Also, when you're traveling, it's nice. And then you can also have one SIM card that's for crap you don't care about, and then you just take that one out of your phone and never put it back in until you need to get a verification code or text or something. Then you throw it back in, and then you're good to go, right? Super cheap. You can do that. Um, if you want

multiple phone numbers, use a VoIP service. We can talk about that. When you're messaging, use Signal. That's our best thing right now. Don't use messages. I don't care if it's end toend encrypted. That means that it's not encrypted at the end, meaning that the phone will read whatever is on the other end, right? Um, so don't Yeah, just use use signal. It's better. I'll throw that out there. I I can say that pretty pretty confidently. Don't use some forked version of Signal. Not that that's happened in the last year. Um, so that's how we use our phones and that helps minimize data that gets out from your phone, right? When you're using the internet, um, the first thing you should

do is switch to privacy focused browser. I come from a place where I have to use Chrome for certain things. Um, and those are the things that I use Chrome for. And for everything else, I don't use Chrome. I recommend you do not use Chrome. I know it's great. If you really, really, really are like can't give up Chrome. That's okay. Brave is a really easy transition. And you can argue with me all day you want about owners of Brave and whatever. I have trusted friends who have talked to creators of Brave. Um, so this is now secondhand, not not thirdand, but this is secondhand direct from the source um that I I trust Brave enough to be able

to do my web browsing on Brave, right? Um, so we can we can discuss those later and I know in the in the in the comments of YouTube, I'll get some more haters and that's okay. Um, but that's a really easy transition. My grandma can switch from Chrome to Brave, so you can do too, right? So please try that. If you want to go better, there's a Malvad browser. There are like Linux browsers, Libra wolf for tour browser if you want to go down that route. On your phone, there's duck.go browser. I don't know on a scale of Chrome to whatever, like not searching the internet, those all lie. But I'll tell you where they don't lie

is they don't lie at Chrome. So they'll be leaking a lot less information. Try doing that. Um there's if you want to do it in your command line, there's browse 6L if you've never seen that. Like it'll render web pages in command line. That's a that's an interesting deal. I don't recommend it, but it worked. So, uh, use a VPN and never reuse usernames or passwords. We should all be using a password manager. If you're not, please, please catch up to the times. Use a password manager and then have it generate your username, too, because there's no reason you should ever reuse a username. A username is Yeah. Why do we need Why do you need to use the same username

everywhere, right? Because we've been conditioned to do that. That's why. So, that's the end of that. All right. Um, last couple things as far as stemming the bleeding. Uh, human interaction whenever you have to interact with a human, right? This seems silly. Vet your contacts. Um, I think there's a there are a couple of horror stories about people inviting you to next door so they can watch you on your neighborhood and you can be safe. But in reality, we all know it's just grandma's complaining about like the length of your yard and then reporting it to the HOA. Don't do next door things like that, right? Like you vet your contacts. Um, I know this

seems crazy. I know if some of my neighbors watch this, they're going to think I'm weird, but I don't when I meet a neighbor, I don't ever give my real phone number. I give them a different phone number. And I have like a like a semi-rusted phone number. That's where I get to give to my people. And then and then if if you're cool, I don't it seems if you're cool enough, you get on my list. But like we don't need to give your phone number to everybody, right? You don't. And in fact, I have a phone number that I've never given to anybody that just hosts on my VOIPE uh phones, my VoIP lines. And I have I I literally

don't even know what that phone number is. I've never given it out. I've never even looked at it, right? So I don't I don't know. It's just on a SIM card that I have on my phone, but you can do that. That's okay, right? Um give out fake info whenever you need to until you trust somebody. I love when you go to the when you go to a store and you have to check out and they're like, "What's your phone number?" Just say 8675309. If you're old enough, you're cool. If you're young enough and you don't know what this is, go get smart. So search 8675309. Listen to the song. you'll never forget it for the rest of your life. And it

works. And if you have to give out your social security number and they're like, "Well, what's your social security number? We need this." And you're like, "Why do you need your social security number?" Uh, you can give out 867- or 005309. For your reference, there are no US social security numbers with 00 in the middle. So, if you ever need one to come up with, uh, none start with 666. I mean, there might be one, but we're not going to talk about him right now. And then um no social security numbers start with a nine ever in the US. So if you need to give out a phone a fake social security number, you can put nine there.

And that's that as as the first number. It's not going to be anybody's real number. Just throwing that out there. The only places that really need your social or your social are schools if you're applying for FAFSA, employers, and um your doctor's office only if you're a Medicare or Medicaid patient. I don't know if you knew that, but that's so you can just put zeros. The doctor doesn't need your information for social security numbers. Throwing that out there. Uh, use a passport card. I've talked about this that doesn't have your e or your your mailing address on it, and that makes it nice. And then don't reuse payment information. You can do that with privacy.com. You can sign up

and create burner credit card numbers like I just did. You can do it at home. You can sign up for a different credit card number for each vendor that you go to. I have one for my Steam account. I have a completely different one for my Amazon account. I have a completely different one for my Netflix account. I have a completely different one for my Disney account. Whatever. If you have those things, right, you would have that many different uh credit cards. I I don't know how many I'm at. Probably 120 or 130 different credit cards right now. Uh and it's you think, "Oh, that's crazy." But that's that's how the rich people live their lives. I'm not one of

those rich people, but I can live like that, right? Like I can pretend to be one, right? They don't care because they don't have to worry about it. they just have somebody who takes care of it for them and they just make up new credit card numbers. We should be able to do it, too. And privacy.com lets you do it. Okay, I only have like three four minutes left. So, the next one is poison the water hole. And we'll talk about this real quick. Um, you can give out misinformation. And um, what I like to do or I guess to give out a real quick definition of disinformation is purposeful and intentional remix or mixing of true information with false

information. So what you would do for example is I could give my real address and say that Jebidiah Throck Morton lives there and then when I get a when I start getting mail in the name of Jebidiah Throm Morton it's crazy how fast the USPS picks up on that and it's crazy how fast then other data brokers pick up on that and before you know it when you search your address it'll be your name and then underneath it a couple of Google searches down it'll say Jebidiah Throck Morton and you're like yes okay so that's cool. So you get to a point where you can then poison the information. The AI hive minds will say,

"Oh yeah, Jebidia must live there because he's sending mail to that address." Right? Or you could use your real name and a fake address, which I did recently. I'll tell you about that in a second. Um you could also maybe make a social media profile with fake information. You could put your real name and fake information, right? Uh and and that also throws the scent off. But the more you do these kinds of things, the harder it is for people to find your real information. And that's what's awesome about it, right? The more that you do this, the harder it is for other people to find their information. I recently went and donated the I tried to

donate the minimum number of dollars that I could to our two major political parties in the US. I'm going to reinforce your stereotypes. One of those parties was unable or did not want to take my fake credit card number. The other one was like, we'll take whatever money you give us. So, this is reinforcing your stereotypes. Um, and so, but I put my name there and then I went and looked, I did a search for new builds, new apartments, Salt Lake City, and I found this uh apartment building that was just built in Salt Lake City. And I looked at they have floor plans. So, I saw that there is no number 499. So, I just put my name. I put this real

address which was accepted and then apartment number 499 which doesn't exist obviously, right? But the mailing address is real and this political party seeped up that information was like, "Yes, I did this four weeks ago and I did a search yesterday and I saw my name with this address which is great." So now as this continues to propagate throughout the world, um hopefully people will be like, "Well, does Ivon live here?" Like that I think that's that's where he lives in apartment 499. And then that's great, right? That's awesome. So you can did I did I didn't even show this picture, man. Was that even up? I don't know. Here it is. If you didn't see that,

right? Okay. Yeah. All right. So that's totally something you can do. And I think that's great. So that kind of stuff is great. If you're in another dire situation, um, you can use an address that doesn't exist. You can rent an apartment for a month. This is something that's kind of crazy. I did this search. I did a Zillow search. Um, and I asked it for like the cheapest rent in Salt Lake City right now. I joke you not. This is the picture that came up, but it's 175 bucks. Now, you can rent this for 175 bucks a month. You can go and sign a one-mon contract. just say you I mean you could just sign

up and say 1175 bucks it'll be a legal address for you right and then once you're done with that once you're once you're done with that legal address then you can use that on any misinformation that you do in the future right so that's another thing that we can do um I'm out of time that's probably why it went off you can try using a oh no here we go you can try using a personal mailbox or a PO box uh that also works and and I think That's that's like a really good thing to do to hide your address. And last thing that I'll share about with this information here, um, we've talked about how you can

do email. We've talked about how you can do phone numbers and usernames and password information or payment information. Right? Take this and then share that as widely as you can like I just did with this credit card number. Right? I know that right now there's a there there some people have already uploaded that credit card number to the Google cloud just automatically because it's on your phone or Apple cloud. So, I know that this credit card number is now gone. And I know if it ever gets charged again in the future, and I get a notification, like two months down the line, it's because Google leaked it somewhere or someone got into one of your

accounts, right? So, but share it. Share all this fake information as much as you can and and and hide what whatever is true about you and share the fake stuff. And it's surprisingly effective and it works great. Um, I'm I'm about done. So, I'm I think I'm gonna stop here because we don't have time to talk about any other things, but if there are any questions that I can answer real quick in the you know, like 105 second answers, I would love to do that and uh we'll go from there. Yes, real quick question. >> With age verification, >> how do you deal with age verification? Um, well, I'm not going to say this is

what I do, but let's say you are over 18. I mean, the real the real question is, are you over 18? And if you are, then I have no problem putting January 1st on January 111, like January 1st of 20 or 2001 as my age because for all they care about, that's as true as my real birth date. Right? If there's something that won't give you access unless you scan a face or a card, either go do Death Stranding and take a picture of whatever his name's face is because that works to get you past age verification face checks or um or you can just not use that service. Like I it's to that point where I'm like I

don't know why you need this information, right? If they need a credit card, sometimes they'll have other ways of taking it. You can spin up a fake credit card, give them that. that'll verify that you're 18 just as much as me checking the box would, right? But yeah, those are good questions. >> When it comes to residences and disinformation, can't use hotels. >> Uh when it comes to residences and misinformation, a hotel is a legal residence for that time. So yes, there are times where I have purchased services and it says we need your we need your address and uh and so you can use a hotel and do that. So maybe quick buy something while you're here, use

your hotel address and then spread that information. All right, my time's up and I love Pope. He's up next, so I'm going to get off the stage. If you want to talk more about privacy, uh, please feel free to reach out and we can chat more later. Thanks so much.